26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] a9:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample 739eba9ecc9a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 739eba9ecc9a…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 3/27 AV engines flagged this file. 14 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e"],"about":{"@type":"SoftwareApplication","name":"kythy.exe","applicationCategory":["peexe","executable","compressed","sfx","7zip"],"identifier":"739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":14,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1145,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00007916.00000000.163549.00B91000.00000020.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "00000000-00007916.00000000.163549.00B91000.00000020.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00007916.00000000.163549.00B91000.00000020.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "VirtualAllocdBlocks" (Indicator: "VirtualAlloc"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtWow64AllocateVirtualMemory64" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "NtWow64WriteVirtualMemory64"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLookaside" (Indicator: "FreeMemory"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp")28:T1429,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwOpenThread" (Indicator: "OpenThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found reference to API "RtlWow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp")29:T78c,Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "NtCreateThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp")2a:T131c,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "00000000-00007916.00000000.163549.00B91000.00000020.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "NtDelayExecution" (Indicator: "NtDelayExecution"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtSetTimer" (Indicator: "SetTimer"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtSetTimerResolution" (Indicator: "SetTimer"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp")2b:T91a,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "NtImpersonateThread" (Indicator: "NtImpersonateThread"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp")2c:Td81,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "00000000-00007916.00000000.163549.00B91000.00000020.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "After a callback to 0x%p(0x%p), an completion call to FreeLibrary(%p) failed with status 0x%08x." (Indicator: "FreeLibrary"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp")2d:T989,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "!"#$%&'()*+,-./0123ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp"), Found string "!"#$%&'()*+ -./0123ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp")2e:Ta2f,Found reference to "The cryptographic provider does not support HMAC." (Indicator: "HMAC"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to "RC2a" (Indicator: "RC2"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to "CALG_RC2" (Indicator: "RC2"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to "CALG_HMAC" (Indicator: "HMAC"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to "TLS_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to "%s4-HMAC-SHA256" (Indicator: "HMAC"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to "Authorization: %s4-HMAC-SHA256 Credential=%s/%s, SignedHeaders=%s, Signature=%s" (Indicator: "HMAC"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to ".?AVCBaseCoder@NWzAes@NCrypto@@" (Indicator: "Aes"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to ".?AVCDecoder@NWzAes@NCrypto@@" (Indicator: "Aes"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to ".?AVCAesCbcCoder@NCrypto@@" (Indicator: "Aes"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to ".?AUCAesCbcDecoder@NCrypto@@" (Indicator: "Aes"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to ".?AUCAesCbcEncoder@NCrypto@@" (Indicator: "Aes"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to ".?AVCEncoder@NWzAes@NCrypto@@" (Indicator: "Aes"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp")2f:T8fa,Found PE header "MZ" - Source: "00000000-00001008.00000001.164707.01090000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000001.165588.05470000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000001.165588.05480000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000001.165588.15430000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000001.165588.16744000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000001.165588.16814000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000001.165588.16C93000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000002.167507.00F90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000002.167507.0158B000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000002.167507.05470000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000002.167507.05480000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000002.167507.0559C000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000002.167507.05CA0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000002.167507.15430000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000002.167507.16814000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000003.171537.00F90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000003.171537.15430000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002396.00000003.171537.16814000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003924.00000002.163546.5BAC0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003924.00000002.163546.63D65000.00000004.mdmp")30:T53c,Found string - \\.\360SelfProtection; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found string - \\.\Scsi%d:; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found string - \\.\PhysicalDrive%d; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found string - \.\DISPLAY1; Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp, 00000000-00002396.00000003.171537.00F90000.00000004.mdmp") Found string - \\.\DISPLAY1; Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp, 00000000-00002396.00000003.171537.00F90000.00000004.mdmp") Found string - ; Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp") Found string - ; Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp") Found string - \\.\DISPLAY_VIRTUAL; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp")31:T7f9,"" (Indicator: "enumchildwindows"; Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp, 00000000-00002396.00000003.171537.00F90000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "WMRSendMessageString" (Indicator: "sendmessage"; Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp")42:T2057,"" in Source: 00000000-00002396.00000001.165588.00F90000.00000004.mdmp "" in Source: 00000000-00002396.00000001.165588.00F90000.00000004.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\314559 [AvailabilityForAllContentIds]" in Source: 00000000-00002396.00000001.165588.00F90000.00000004.mdmp 00000000-00002396.00000001.165588.16744000.00000004.mdmp 00000000-00002396.00000002.167507.00F90000.00000004.mdmp 00000000-00002396.00000002.167507.16744000.00000004.mdmp 00000000-00002396.00000003.171537.00F90000.00000004.mdmp 00000000-00002396.00000003.171537.16744000.00000004.mdmp "MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion [EditionID]", "Server")" in Source: 00000000-00002396.00000001.165588.00F90000.00000004.mdmp 00000000-00002396.00000001.165588.16744000.00000004.mdmp 00000000-00002396.00000002.167507.00F90000.00000004.mdmp 00000000-00002396.00000002.167507.16744000.00000004.mdmp 00000000-00002396.00000003.171537.00F90000.00000004.mdmp 00000000-00002396.00000003.171537.16744000.00000004.mdmp "MigXmlHelper.DoesStringContentContain("Registry", "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion [EditionID]", "PPIPro")" in Source: 00000000-00002396.00000001.165588.00F90000.00000004.mdmp 00000000-00002396.00000001.165588.16744000.00000004.mdmp 00000000-00002396.00000002.167507.00F90000.00000004.mdmp 00000000-00002396.00000002.167507.16744000.00000004.mdmp 00000000-00002396.00000003.171537.00F90000.00000004.mdmp 00000000-00002396.00000003.171537.16744000.00000004.mdmp "\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU [UseWUServer]" "0x00000001")" in Source: 00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp, 00000000-00002396.00000003.171537.00F90000.00000004.mdmp, "MigXmlHelper.DoesStringContentEqual("Registry", "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CreatorsUpdatePrivacySettings [ShowUI]", "0x00000000")" in Source: 00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp, 00000000-00002396.00000003.171537.00F90000.00000004.mdmp, "HKLM\Software\Microsoft\Windows\CurrentVersion\Privacy [TailoredExperiencesWithDiagnosticDataEnabled]" in Source: 00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp, 00000000-00002396.00000003.171537.00F90000.00000004.mdmp, "MigXmlHelper.DoesObjectExist("Registry", "HKLM\Software\Microsoft\Windows\CurrentVersion\Privacy [TailoredExperiencesWithDiagnosticDataEnabled]")" in Source: 00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp, 00000000-00002396.00000003.171537.00F90000.00000004.mdmp, "" in Source: 00000000-00002396.00000001.165588.00F90000.00000004.mdmp, "" in Source: 00000000-00002396.00000001.165588.00F90000.00000004.mdmp, "" in Source: 00000000-00002396.00000001.165588.00F90000.00000004.mdmp, "" in Source: 00000000-00002396.00000001.165588.00F90000.00000004.mdmp, "" in Source: 00000000-00002396.00000001.165588.00F90000.00000004.mdmp, "" in Source: 00000000-00002396.00000001.165588.00F90000.00000004.mdmp, "SYSTEM\CurrentControlSet\Services" in Source: 00000000-00002396.00000001.165588.01512000.00000002.mdmp, "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00002396.00000001.165588.01512000.00000002.mdmp, "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002396.00000001.165588.01512000.00000002.mdmp, "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Software\Microsoft\Windows" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00002396.00000001.165588.0601F000.00000004.mdmp 00000000-00002396.00000001.165588.16C93000.00000004.mdmp 00000000-00002396.00000002.167507.0559C000.00000004.mdmp 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp58:T5a1,Process '" - Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found URL "http://www.360totalsecurity.com/d/ts/%s/%s/open\i18n\i18n.inilanguagemaindefaultlanguage\softmgr\advutils.inilangqurldefault_langsoftware\360machinesignatureoperatorissuedateexpirationdatesigndata%hu-%hu-%hu" - Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp") Found URL "https://error:" - Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found URL "http://prematch^nlast_submatch_resultlast_paren_matchmatchwindir%\explorer.exe" - Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found URL "https://curl.se/docs/http-cookies.html" - Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found URL "https://curl.se/docs/alt-svc.html" - Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found URL "http://example.cominclude_filterfilesexclude_regexinclude_regexexclude_filterheightwidthmonitorsiverwindowusercomputerratejpegbuildidjpeg_heightjpeg_widthhashesldrshutdownthreadntworkerfactoryworkerreadyntcreatethreadexdataportnonetunnelportcontrolportresult%02xiostream" - Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found URL "https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newreport" - Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp") Found URL "http://support.microsoft.com/?kbid=777777" - Source: "00000000-00002396.00000001.165588.16814000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qv68209241008,1940,3,hfindfile,0,0,,1667630068209241008,1940,6,lpfindfiledata,1,1,0,@7beeff4,592,20000000384cac1b9004d401384cac1b9004d401826b4c6a4dd1d30100000000df09000046696c6554696d6577006f007700360034005f006d006900630072006f0073006f00660074002d00770069006e0064006f00770073002d006d002e002e006100700068006f00730074007200650073002e007200650073006f00750072006300650073005f0033003100620066003300380035003600610064003300360034006500330035005f00310030002e0030002e00310037003100330034002e0031005f0065006c002d00670072005f0036003300370066003000300038003200330061003100300062003700380064002e006d0061006e0069006600650073007400000073007400000003000000106c04012010ff000d000000000000002000000000009e00dc019e00dc0a9e0000000000d80a9e003cf1be0770f1be075916597740000000000000003cf2be070000f90000009e0048000000000000000000000009000000020000000000f90040000000000000002000000090f1be07ee1359771f000000ee1359770000000000000000400000003cf2be07466d0401486d0401bcf1be078e364d010000000050f558774226927f3cf2be0780f8be0700f1be071010ff0050f558774226927faf75aeca80f8be07d80a9e001010ff0080f8be0761fb32019cf2be07a7e04f01fffffffff8f1be075e01330158f5be0701000000a8f2be07ea063a0158f5be0734f5be0780f8be07e41cd401186d040120f2be07bfe44a01186d04017cf2be07d7ff390157004f0031003200360033007e0031002e004d0041004e000000040168209241008,1940,9,$name,2,0,," - Source: "00000000-00002396.00000001.165588.16814000.00000004.mdmp") Found URL "http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd" - Source: "00000000-00002396.00000002.167507.00F90000.00000004.mdmp") Found URL "https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newreport" - Source: "00000000-00002396.00000002.167507.0158B000.00000004.mdmp") Found URL "http://www.microsoft.com/contentredirect.asp?" - Source: "00000000-00002396.00000002.167507.15430000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=8180" - Source: "00000000-00002396.00000002.167507.15430000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=8181" - Source: "00000000-00002396.00000002.167507.15430000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002396.00000002.167507.15430000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0q" - Source: "00000000-00002396.00000002.167507.16814000.00000004.mdmp") Found URL "http://www.w3.org/1999/xhtml" - Source: "00000000-00002396.00000002.167507.16814000.00000004.mdmp") Found URL "https://github.com/npm/rfcs/blob/latest/implemented/0019-remove-update-depth-option.md')" - Source: "00000000-00002396.00000003.171537.00F90000.00000004.mdmp") Found URL "https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newreport" - Source: "00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found URL "http://moneycentral.msn.com/investor/external/excel/quotes.asp?symbol=[" - Source: "00000000-00002396.00000003.171537.15430000.00000004.mdmp") Found URL "https://[csuffix.org/public_suffix_list.dathome_url:" - Source: "00000000-00002396.00000003.171537.15430000.00000004.mdmp") Found URL "https://publicsuffix.org/owner:" - Source: "00000000-00002396.00000003.171537.15430000.00000004.mdmp") Found URL "https://publicsuffix.org/list/public_suffix_list.dathome_url:" - Source: "00000000-00002396.00000003.171537.15430000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002396.00000003.171537.15430000.00000004.mdmp") Found URL "https://publicsuffix.org/list/public_suffix_list.dathome_url:" - Source: "00000000-00002396.00000003.171537.16744000.00000004.mdmp") Found URL "https://publicsuffix.org/owner:" - Source: "00000000-00002396.00000003.171537.16744000.00000004.mdmp") Found URL "https://nodejs.org/api/corepack.hkrakenbybittstall" - Source: "00000000-00002396.00000003.171537.16814000.00000004.mdmp") Found URL "https://registry.npmjs.org/@yarnpkg/cli-dist/-/cli-dist-3.2.3.tgz" - Source: "00000000-00002396.00000003.171537.16814000.00000004.mdmp") Found URL "https://registry.npmjs.org" - Source: "00000000-00002396.00000003.171537.16814000.00000004.mdmp") Found URL "https://github.com/npm/cli/edit/latest/docs/content/commands/npm-install-test.md" - Source: "00000000-00002396.00000003.171537.16814000.00000004.mdmp") Found URL "https://github.com/npm/cli/edit/latest/docs/content/commands/npm-exec.md" - Source: "00000000-00002396.00000003.171537.16814000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpgif89a)8p,u--8,c-ucc8" - Source: "00000000-00002396.00000003.171537.16814000.00000004.mdmp") Found URL "http://ns.adobe.com/xap/1.0/9iqmgvw,czcrl.thawtbhv*8tpa2.5.29.1thawte," - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eriss2.5.29.100" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?verisign," - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]hrstwx" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l3k*jgz;" - Source: "00000000-00006820.00000001.164201.E6B80000.00000004.mdmp")74:T2335,GET / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html application/xhtml+xml application/xml;q=0.9 */*;q=0.8 Accept-Encoding: gzip deflate Accept-Language: en-US en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; ARM64 Mac OS X 10_15_7) Chrome/148.0.0.0 Safari/537.35 Host: 65.21.96.128 GET /time/1/current?cup2key=9:odSQqdRo8gXFjMY-3borJ3tGq3gjXTKembBhAS117FI&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1 Host: clients2.google.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Accept-Encoding: gzip deflate GET /abusiveadblocking/api/v1/blocklist HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive If-None-Match: "5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B" Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip deflate br zstd GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: safebrowsingohttpgateway.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Ohttppublickey-Fst: true Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2 Host: clientservices.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors If-None-Match: SMChYyMDI2MDEzMS0wMzAwMTIuNDk5MDAwEgkIABADGJABIAAaEAoIMTc2OTk0MzYSBAgCEAE=#FG5ZMGD4i5w= Sec-Fetch-Site: none A-Im: x-bm gzip Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /og/_/ss/k=og.qtm.MP0ErHRRYUE.L.W.O/m=qmd qcwid d_b_gm3 d_wi_gm3 d_lo_gm3/excm=qaaw qabr qadd qaid qalo qebr qein qhaw qhawgm3 qhba qhbr qhbrgm3 qhch qhchgm3 qhga qhid qhidgm3 qhin qhlo qhlogm3 qhmn qhpc qhsf qhsfgm3 qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTszFACM37gWO-an1VpkUy66bmAYRg HTTP/2 Host: www.gstatic.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors X-Browser-Year: 2026 Sec-Fetch-Storage-Access: active Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 X-Browser-Validation: mbKdpV8Df6MeX3t+QoahfSgokv4= Priority: u=0 Accept: text/css */*;q=0.1 X-Browser-Channel: stable Sec-Ch-Ua: "Not(A:Brand";v="8" "Chromium";v="144" "Google Chrome";v="144" Sec-Ch-Ua-Mobile: ?0 X-Client-Data: CN7cygE= Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd X-Browser-Copyright: Copyright 2026 Google LLC. All Rights reserved. Sec-Fetch-Dest: style GET /downloads?name=1767628897&target=OPTIMIZATION_TARGET_NOTIFICATION_PERMISSION_PREDICTIONS HTTP/2 Host: optimizationguide-pa.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: navigate Sec-Fetch-Site: none X-Goog-Api-Key: AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE Accept-Language: en-US en;q=0.9 Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /REST/v1/Imagery/Map/roadondemandfull/40.751 -73.964/5?mapSize=268 136&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|lv:1_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US HTTP/2 Host: ecn.dev.virtualearth.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: u=1 i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67" Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US en;q=0.9 Priority: i Accept: image/avif image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99" "Microsoft Edge";v="145" "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: image GET /mouse-gesture/config.json HTTP/2 Host: edge-consumer-static.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /crx/blobs/AXJDbcA7-qvp7x7j_5QmmktTZ2YyNd3kU7eWGoNes-yTz0zj4fWyFlD-Vi_ngMpHdm_8woSV0_ojLaO96xzeFfVgoJD022kEWu-_knETVT9QF_3w4dY4DKgd6rElhsRelgcAxlKa5d02n9hxYZBm9sgkym3onVcyGxJJ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-Os: Windows Priority: u=4 i Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Accept-Encoding: gzip deflate br zstd Sec-Mesh-Client-Os-Version: 10.0.16299 Sec-Mesh-Client-Webview: 0 Sec-Fetch-Dest: empty GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2 Host: edgeassetservice.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Accept-Language: en-US en;q=0.9 Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty GET /tools/pso/ping?as=chrome&brand=HKFL&pid=&hl=en&events=C1I C2I C7I C1S C7S&rep=2&rlz=C1: C2: C7:&id=1375117AE076051ADA4CA9791DB5927747462E05FA49926AD2 HTTP/2 Host: clients1.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Priority: u=4 i Accept-Encoding: gzip deflate br zstd Sec-Fetch-Dest: empty 75:T111ea,Contains base62 string in header "e3b0c44298fc1c149afbf4c8996fb9242" in header "GET /time/1/current?cup2key=9:odSQqdRo8gXFjMY-3borJ3tGq3gjXTKembBhAS117FI&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP/1.1Host: clients2.google.comConnection: keep-alivePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate" Contains base62 string in header "f1a86316958bb6ccd6a36539d591d40b8" in header "POST /componentupdater/api/v1/update?cup2key=7:pTAcclTE9Orc_eFFrnU_YcbFKFr1jlYKrfS2Id_gbr8&cup2hreq=f1a86316958bb6ccd6a36539d591d40b8f257aa8b2d4edb9c869c68cd8c8b692 HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveContent-Length: 11728X-Microsoft-Update-AppId: eeobbhfgfagbclfofmgbdfoicabjdbkn,pghocgajpebopihickglahgebcmkcekh,oankkpibpaokgecfckkdkgaoafllipag,kpfehajjjbbcifeehjgfgnabifknmdad,ohckeflnhegojcjlcpbfpciadgikcohk,fppmbhmldokgmleojlplaaodlkibgikh,ndikpojcjlepofdkaaldkinkjbeeebkl,laoigpblnllgcgjnjnllmfolckpjlhki,efniojlnjndmcbiieegkicadnoecjjef,fgbafbciocncjfbbonhocjaohoknlaco,mpicjakjneaggahlnmbojhjpnileolnb,ojblfafjmiikbkepnnolpgbbhejhlcim,jbfaflocpnkhbgcijpkiafdpbjkedane,gllimckfbolmioaaihpppacjccghejen,kmkacjgmmfchkbeglfbjjeidfckbnkca,llmidpclgepbgbgoecnhcmgfhmfplfao,cllppcmmlnkggcmljjfigkcigaajjmid,ahmaebgpfccdhgidjaidaoojjcijckba,lkkdlcloifjinapabfonaibjijloebfb,plbmmhnabegcabfbcejohgjpkamkddhn,mkcgfaeepibomfapiapjaceihcojnphg,jcmcegpcehdchljeldgmmfbgcpnmgedo,hjaimielcgmceiphgjjfddlgjklfpdei,pbdgbpmpeenomngainidcjmopnklimmf,lfmeghnikdkbonehgjihjebgioakijgnX-Microsoft-Update-Interactivity: bgX-Microsoft-Update-Service-Cohort: 5102X-Microsoft-Update-Updater: msedge-145.0.3800.58Content-Type: application/jsonSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.16299Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0X-Client-Data: CPn8ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstd" Contains base62 string in header "lfmeghnikdkbonehgjihjebgioakijgnX" in header "POST /componentupdater/api/v1/update?cup2key=7:pTAcclTE9Orc_eFFrnU_YcbFKFr1jlYKrfS2Id_gbr8&cup2hreq=f1a86316958bb6ccd6a36539d591d40b8f257aa8b2d4edb9c869c68cd8c8b692 HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveContent-Length: 11728X-Microsoft-Update-AppId: eeobbhfgfagbclfofmgbdfoicabjdbkn,pghocgajpebopihickglahgebcmkcekh,oankkpibpaokgecfckkdkgaoafllipag,kpfehajjjbbcifeehjgfgnabifknmdad,ohckeflnhegojcjlcpbfpciadgikcohk,fppmbhmldokgmleojlplaaodlkibgikh,ndikpojcjlepofdkaaldkinkjbeeebkl,laoigpblnllgcgjnjnllmfolckpjlhki,efniojlnjndmcbiieegkicadnoecjjef,fgbafbciocncjfbbonhocjaohoknlaco,mpicjakjneaggahlnmbojhjpnileolnb,ojblfafjmiikbkepnnolpgbbhejhlcim,jbfaflocpnkhbgcijpkiafdpbjkedane,gllimckfbolmioaaihpppacjccghejen,kmkacjgmmfchkbeglfbjjeidfckbnkca,llmidpclgepbgbgoecnhcmgfhmfplfao,cllppcmmlnkggcmljjfigkcigaajjmid,ahmaebgpfccdhgidjaidaoojjcijckba,lkkdlcloifjinapabfonaibjijloebfb,plbmmhnabegcabfbcejohgjpkamkddhn,mkcgfaeepibomfapiapjaceihcojnphg,jcmcegpcehdchljeldgmmfbgcpnmgedo,hjaimielcgmceiphgjjfddlgjklfpdei,pbdgbpmpeenomngainidcjmopnklimmf,lfmeghnikdkbonehgjihjebgioakijgnX-Microsoft-Update-Interactivity: bgX-Microsoft-Update-Service-Cohort: 5102X-Microsoft-Update-Updater: msedge-145.0.3800.58Content-Type: application/jsonSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.16299Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0X-Client-Data: CPn8ygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstd" Contains base62 string in header "5E25271B8190D943537AD3FDB50874FC1" in header "GET /abusiveadblocking/api/v1/blocklist HTTP/1.1Host: edge.microsoft.comConnection: keep-aliveIf-None-Match: "5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B"Sec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.16299Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstd" Contains base62 string in header "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1Uk" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "ZidUd5R1FaVllST1dpV2lnTUs0R2lNbGx" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "iaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXq" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMV" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "KkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "3HixIdcVTdU37rt795QBlTQIVfYuvs7he" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "fBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "4R3tvjva40uAfUhIKNxtcg52DO_vs2QYe" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrX" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMp" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "BLvzp7XdE35UM7g6B5ed6szp57s0EdmEG" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00t" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZ" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "cERwJkg4dKTDRl5i01aOzG9SURirOsSe8" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "thYTLRiU7fic8kaMftQYYQNjyqhzySI7u" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFK" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "Ef7whlKyGeCYGdBdgP4NtSDyx0TwRjfEn" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "RH3zN7An0eDRPvtTbevIykHn4wvyeCSeD" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGj" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHU" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgb" in header "POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveContent-Type: application/xmlUser-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64)MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0Content-Length: 3767Host: nw-umwatson.events.data.microsoft.com" Contains base62 string in header "AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLo" in header "GET /v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: safebrowsingohttpgateway.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneX-Ohttppublickey-Fst: truePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "SMChYyMDI2MDEzMS0wMzAwMTIuNDk5MDA" in header "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2Host: clientservices.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsIf-None-Match: SMChYyMDI2MDEzMS0wMzAwMTIuNDk5MDAwEgkIABADGJABIAAaEAoIMTc2OTk0MzYSBAgCEAE=#FG5ZMGD4i5w=Sec-Fetch-Site: noneA-Im: x-bm,gzipPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "wEgkIABADGJABIAAaEAoIMTc2OTk0MzYS" in header "GET /chrome-variations/seed?osname=win&channel=stable&milestone=144 HTTP/2Host: clientservices.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsIf-None-Match: SMChYyMDI2MDEzMS0wMzAwMTIuNDk5MDAwEgkIABADGJABIAAaEAoIMTc2OTk0MzYSBAgCEAE=#FG5ZMGD4i5w=Sec-Fetch-Site: noneA-Im: x-bm,gzipPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "QhXUdaTzjFrMXE02QLVt1k2WiA2ynA_Ou" in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2Host: accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedSec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=528=QhXUdaTzjFrMXE02QLVt1k2WiA2ynA_Ouitn5zVri5chg-ukoTgYHQqPwZlXVkdBvNMB26_e5gW-W6OVoS55ZRjtV0CyjY4CIiVzvFX2jlGZQ50u3H4wQZnvLRINRlqJzGWs5mxNAW9YngPdKM-e4oqI5XZZmCqH7FiypPa4aKfkIazg9A5hLQfxLf0kwtWx7tWlSSitigNSTN50bRnL1UQpfMkcsvKaFjsOrigin: https://www.google.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "W6OVoS55ZRjtV0CyjY4CIiVzvFX2jlGZQ" in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2Host: accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedSec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=528=QhXUdaTzjFrMXE02QLVt1k2WiA2ynA_Ouitn5zVri5chg-ukoTgYHQqPwZlXVkdBvNMB26_e5gW-W6OVoS55ZRjtV0CyjY4CIiVzvFX2jlGZQ50u3H4wQZnvLRINRlqJzGWs5mxNAW9YngPdKM-e4oqI5XZZmCqH7FiypPa4aKfkIazg9A5hLQfxLf0kwtWx7tWlSSitigNSTN50bRnL1UQpfMkcsvKaFjsOrigin: https://www.google.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "50u3H4wQZnvLRINRlqJzGWs5mxNAW9Yng" in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2Host: accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedSec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=528=QhXUdaTzjFrMXE02QLVt1k2WiA2ynA_Ouitn5zVri5chg-ukoTgYHQqPwZlXVkdBvNMB26_e5gW-W6OVoS55ZRjtV0CyjY4CIiVzvFX2jlGZQ50u3H4wQZnvLRINRlqJzGWs5mxNAW9YngPdKM-e4oqI5XZZmCqH7FiypPa4aKfkIazg9A5hLQfxLf0kwtWx7tWlSSitigNSTN50bRnL1UQpfMkcsvKaFjsOrigin: https://www.google.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "e4oqI5XZZmCqH7FiypPa4aKfkIazg9A5h" in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2Host: accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedSec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=528=QhXUdaTzjFrMXE02QLVt1k2WiA2ynA_Ouitn5zVri5chg-ukoTgYHQqPwZlXVkdBvNMB26_e5gW-W6OVoS55ZRjtV0CyjY4CIiVzvFX2jlGZQ50u3H4wQZnvLRINRlqJzGWs5mxNAW9YngPdKM-e4oqI5XZZmCqH7FiypPa4aKfkIazg9A5hLQfxLf0kwtWx7tWlSSitigNSTN50bRnL1UQpfMkcsvKaFjsOrigin: https://www.google.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "LQfxLf0kwtWx7tWlSSitigNSTN50bRnL1" in header "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2Host: accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedSec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Cookie: NID=528=QhXUdaTzjFrMXE02QLVt1k2WiA2ynA_Ouitn5zVri5chg-ukoTgYHQqPwZlXVkdBvNMB26_e5gW-W6OVoS55ZRjtV0CyjY4CIiVzvFX2jlGZQ50u3H4wQZnvLRINRlqJzGWs5mxNAW9YngPdKM-e4oqI5XZZmCqH7FiypPa4aKfkIazg9A5hLQfxLf0kwtWx7tWlSSitigNSTN50bRnL1UQpfMkcsvKaFjsOrigin: https://www.google.comPriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLo" in header "POST /v1:GetModels?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2Host: optimizationguide-pa.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Content-Type: application/x-protobufSec-Fetch-Mode: no-corsSec-Fetch-Site: noneX-Client-Data: CN7cygE=Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLo" in header "GET /downloads?name=1767628897&target=OPTIMIZATION_TARGET_NOTIFICATION_PERMISSION_PREDICTIONS HTTP/2Host: optimizationguide-pa.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: navigateSec-Fetch-Site: noneX-Goog-Api-Key: AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhEAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base62 string in header "ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyT" in header "GET /REST/v1/Imagery/Map/roadondemandfull/40.751,-73.964/5?mapSize=268,136&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|lv:1_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US HTTP/2Host: ecn.dev.virtualearth.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: u=1, iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "222166F75FD3671F181970045E3D66DC;" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "253D222166F75FD3671F181970045E3D6" in header "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2Host: m.adnxs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeReferer: https://ntp.msn.com/Sec-Fetch-Site: cross-siteAccept-Language: en-US,en;q=0.9Priority: iAccept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"X-Edge-Shopping-Flag: 1Accept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: image" Contains base62 string in header "3w4dY4DKgd6rElhsRelgcAxlKa5d02n9h" in header "GET /crx/blobs/AXJDbcA7-qvp7x7j_5QmmktTZ2YyNd3kU7eWGoNes-yTz0zj4fWyFlD-Vi_ngMpHdm_8woSV0_ojLaO96xzeFfVgoJD022kEWu-_knETVT9QF_3w4dY4DKgd6rElhsRelgcAxlKa5d02n9hxYZBm9sgkym3onVcyGxJJ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_" in header "GET /crx/blobs/AXJDbcA7-qvp7x7j_5QmmktTZ2YyNd3kU7eWGoNes-yTz0zj4fWyFlD-Vi_ngMpHdm_8woSV0_ojLaO96xzeFfVgoJD022kEWu-_knETVT9QF_3w4dY4DKgd6rElhsRelgcAxlKa5d02n9hxYZBm9sgkym3onVcyGxJJ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base62 string in header "1375117AE076051ADA4CA9791DB592774" in header "GET /tools/pso/ping?as=chrome&brand=HKFL&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=1375117AE076051ADA4CA9791DB5927747462E05FA49926AD2 HTTP/2Host: clients1.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Sec-Fetch-Mode: no-corsSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty"76:Te64,Found HTTPS GET request to https://65.21.96.128/ Found HTTPS POST request to https://65.21.96.128/ Found HTTPS POST request to https://edge.microsoft.com/componentupdater/api/v1/update?cup2key=7:pTAcclTE9Orc_eFFrnU_YcbFKFr1jlYKrfS2Id_gbr8&cup2hreq=f1a86316958bb6ccd6a36539d591d40b8f257aa8b2d4edb9c869c68cd8c8b692 Found HTTPS GET request to https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist Found HTTPS POST request to https://nw-umwatson.events.data.microsoft.com/Telemetry.Request Found HTTPS GET request to https://safebrowsingohttpgateway.googleapis.com/v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE Found HTTPS GET request to https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=144 Found HTTPS POST request to https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin Found HTTPS GET request to https://www.gstatic.com/og/_/ss/k=og.qtm.MP0ErHRRYUE.L.W.O/m=qmd qcwid d_b_gm3 d_wi_gm3 d_lo_gm3/excm=qaaw qabr qadd qaid qalo qebr qein qhaw qhawgm3 qhba qhbr qhbrgm3 qhch qhchgm3 qhga qhid qhidgm3 qhin qhlo qhlogm3 qhmn qhpc qhsf qhsfgm3 qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTszFACM37gWO-an1VpkUy66bmAYRg Found HTTPS OPTIONS request to https://ogads-pa.clients6.google.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData Found HTTPS POST request to https://android.clients.google.com/checkin Found HTTPS OPTIONS request to https://play.google.com/log?format=json&hasfast=true Found HTTPS POST request to https://optimizationguide-pa.googleapis.com/v1:GetModels?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE Found HTTPS GET request to https://optimizationguide-pa.googleapis.com/downloads?name=1767628897&target=OPTIMIZATION_TARGET_NOTIFICATION_PERMISSION_PREDICTIONS Found HTTPS GET request to https://ecn.dev.virtualearth.net/REST/v1/Imagery/Map/roadondemandfull/40.751 -73.964/5?mapSize=268 136&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|lv:1_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US Found HTTPS GET request to https://trc.taboola.com/sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= Found HTTPS GET request to https://px.ads.linkedin.com/setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= Found HTTPS GET request to https://m.adnxs.com/mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D Found HTTPS GET request to https://edge-consumer-static.azureedge.net/mouse-gesture/config.json Found HTTPS POST request to https://android.clients.google.com/c2dm/register3 Found HTTPS GET request to https://clients2.googleusercontent.com/crx/blobs/AXJDbcA7-qvp7x7j_5QmmktTZ2YyNd3kU7eWGoNes-yTz0zj4fWyFlD-Vi_ngMpHdm_8woSV0_ojLaO96xzeFfVgoJD022kEWu-_knETVT9QF_3w4dY4DKgd6rElhsRelgcAxlKa5d02n9hxYZBm9sgkym3onVcyGxJJ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx Found HTTPS GET request to https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService Found HTTPS POST request to https://www.googleapis.com/chromewebstore/v1.1/items/verify Found HTTPS GET request to https://clients1.google.com/tools/pso/ping?as=chrome&brand=HKFL&pid=&hl=en&events=C1I C2I C7I C1S C7S&rep=2&rlz=C1: C2: C7:&id=1375117AE076051ADA4CA9791DB5927747462E05FA49926AD277:T46c,Short term registered certificate: "accounts.google.com" (83 days old) Short term registered certificate: "android.clients.google.com" (83 days old) Short term registered certificate: "chrome.google.com" (83 days old) Short term registered certificate: "clients1.google.com" (83 days old) Short term registered certificate: "clients2.google.com" (83 days old) Short term registered certificate: "clients2.googleusercontent.com" (83 days old) Short term registered certificate: "clientservices.googleapis.com" (83 days old) Short term registered certificate: "mtalk.google.com" (83 days old) Short term registered certificate: "ogads-pa.clients6.google.com" (83 days old) Short term registered certificate: "optimizationguide-pa.googleapis.com" (83 days old) Short term registered certificate: "play.google.com" (83 days old) Short term registered certificate: "safebrowsingohttpgateway.googleapis.com" (83 days old) Short term registered certificate: "www.google.com" (83 days old) Short term registered certificate: "www.googleapis.com" (83 days old) Short term registered certificate: "www.gstatic.com" (83 days old)78:T517,Found string "A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision." (Indicator: "libcurl"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "A libcurl function was given a bad argument" (Indicator: "libcurl"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "An unknown option was passed in to libcurl" (Indicator: "libcurl"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "libcurl lacks IDN support" (Indicator: "libcurl"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support." (Indicator: "libcurl"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "Unrecognized content encoding type. libcurl understands %s content encodings." (Indicator: "libcurl"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "libcurl error" (Indicator: "libcurl"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp")79:T44f,Found string "+ncalrpc:[OLEA0C29DF09326BE6B2BD96B7B39BB]" (Indicator: "ncalrpc"; Source: "00000000-00001008.00000001.164707.00960000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001008.00000001.164707.00960000.00000004.mdmp") Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00001008.00000001.164707.00960000.00000004.mdmp") Found string "+ncalrpc:[OLE417A65C8C883E2387C5D5D71E23E]" (Indicator: "ncalrpc"; Source: "00000000-00001008.00000001.164707.00960000.00000004.mdmp") Found string "B+ncalrpc:[OLE417A65C8C883E2387C5D5D71E23E]" (Indicator: "ncalrpc"; Source: "00000000-00001008.00000001.164707.00960000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp") Found string "F+ncalrpc:[OLEC1EE081395441917234C5AD3CFAE]" (Indicator: "ncalrpc"; Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp")7a:T12f2,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00001008.00000001.164707.00960000.00000004.mdmp") Found string "The local machine must be a Kerberos KDC (domain controller) and it is not." (Indicator: "kerberos"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "The Kerberos protocol encountered an error while validating the KDC certificate during logon. There is more information in the system event log." (Indicator: "kerberos"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "The Kerberos protocol encountered an error while attempting to utilize the smartcard subsystem." (Indicator: "kerberos"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "The target server does not have acceptable Kerberos credentials." (Indicator: "kerberos"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "An unsupported preauthentication mechanism was presented to the Kerberos package." (Indicator: "kerberos"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "Kerberos sub-protocol User2User is required." (Indicator: "kerberos"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user." (Indicator: "kerberos"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp") Found string "The local machine must be a Kerberos KDC (domain controller) and it is not." (Indicator: "kerberos"; Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp") Found string "The Kerberos protocol encountered an error while validating the KDC certificate during logon. There is more information in the system event log." (Indicator: "kerberos"; Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp") Found string "The Kerberos protocol encountered an error while attempting to utilize the smartcard subsystem." (Indicator: "kerberos"; Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp") Found string "The target server does not have acceptable Kerberos credentials." (Indicator: "kerberos"; Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp") Found string "An unsupported preauthentication mechanism was presented to the Kerberos package." (Indicator: "kerberos"; Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp") Found string "Kerberos sub-protocol User2User is required." (Indicator: "kerberos"; Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp") Found string "The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user." (Indicator: "kerberos"; Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp")7b:T1384,Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetDC" (Indicator: "GetDC"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp, 00000000-00002396.00000003.171537.00F90000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp, 00000000-00002396.00000003.171537.00F90000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp, 00000000-00002396.00000003.171537.00F90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp, 00000000-00002396.00000003.171537.00F90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp, 00000000-00002396.00000003.171537.00F90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp, 00000000-00002396.00000003.171537.00F90000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp, 00000000-00002396.00000003.171537.00F90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp, 00000000-00002396.00000003.171537.00F90000.00000004.mdmp") Found reference to API ".?AVSafeGetDC@@" (Indicator: "GetDC"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp")7c:Tf7a,Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "RtlGetVersion"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "RtlGetVersion"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "RtlGetVersion"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "RtlGetVersion"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "RtlGetNtProductType" (Indicator: "RtlGetNtProductType"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "RtlGetNtVersionNumbers" (Indicator: "RtlGetNtVersionNumbers"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "RtlGetVersion"; Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "RtlGetVersion"; Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "RtlGetVersion"; Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "RtlGetVersion"; Source: "00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp")7d:Tb69,Found registry query API: "RegOpenKeyExW" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry query API: "RegEnumKeyW" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry query API: "RegEnumValueW" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry query API: "RegEnumKeyExW" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry query API: "RegQueryValueExW" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry query API: "RegQueryValueW" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry query API: "RegOpenKeyExA" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry query API: "RegQueryInfoKeyW" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry query API: "RegQueryValueExA" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry query API: "RegEnumKeyExA" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry query API: "SHGetValueA" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry query API: "SHGetValueW" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry query API: "RtlpQueryRegistryValues: Miscomputed buffer size at line %d" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp" Found registry query API: "NtEnumerateKey" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp" Found registry query API: "NtEnumerateValueKey" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp" Found registry query API: "NtQueryKey" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp" Found registry query API: "NtQueryValueKey" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp" Found registry query API: "RtlCheckRegistryKey" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValues" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValuesEx" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp" Found registry query API: "RtlpNtQueryValueKey" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp" Found registry query API: "ZwEnumerateKey" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp" Found registry query API: "ZwEnumerateValueKey" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp" Found registry query API: "ZwQueryKey" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp" Found registry query API: "ZwQueryValueKey" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp"7e:T598,Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "VkKeyScanExW" (Indicator: "VkKeyScan"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "VkKeyScanExW" (Indicator: "VkKeyScanEx"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp")7f:T415,Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStrings"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp")80:T17b5,Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtQuerySecurityObject" (Indicator: "NtQuerySecurityObject"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.16814000.00000004.mdmp, 00000000-00002396.00000002.167507.16814000.00000004.mdmp") Found reference to API "GetUserNameExW" (Indicator: "GetUserName"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.16814000.00000004.mdmp, 00000000-00002396.00000002.167507.16814000.00000004.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "::NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp")81:T790,"RadiantForg.exe" called "FindFirstFileW" with parameter C:\* (UID: 00000000-00002396) "RadiantForg.exe" called "FindNextFileW" with parameter $Recycle.Bin (UID: 00000000-00002396) "RadiantForg.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\* (UID: 00000000-00002396) "RadiantForg.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002396) "RadiantForg.exe" called "FindNextFileW" with parameter S-1-5-18 (UID: 00000000-00002396) "RadiantForg.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\S-1-5-18\* (UID: 00000000-00002396) "RadiantForg.exe" called "FindNextFileW" with parameter desktop.ini (UID: 00000000-00002396) "RadiantForg.exe" called "FindNextFileW" with parameter S-1-5-21-735145574-3570218355-1207367261-1001 (UID: 00000000-00002396) "RadiantForg.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\S-1-5-21-735145574-3570218355-1207367261-1001\* (UID: 00000000-00002396) "RadiantForg.exe" called "FindNextFileW" with parameter $WINDOWS.~BT (UID: 00000000-00002396) "RadiantForg.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\* (UID: 00000000-00002396) "RadiantForg.exe" called "FindNextFileW" with parameter DUDownload (UID: 00000000-00002396) "RadiantForg.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\DUDownload\* (UID: 00000000-00002396) "RadiantForg.exe" called "FindNextFileW" with parameter Setup (UID: 00000000-00002396) "RadiantForg.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\DUDownload\Setup\* (UID: 00000000-00002396) "RadiantForg.exe" called "FindNextFileW" with parameter acmigration.dll (UID: 00000000-00002396) "RadiantForg.exe" called "FindNextFileW" with parameter appraiser.sdb (UID: 00000000-00002396) "RadiantForg.exe" called "FindNextFileW" with parameter diagtrack.dll (UID: 00000000-00002396) "RadiantForg.exe" called "FindNextFileW" with parameter mediasetupuimgr.dll (UID: 00000000-00002396)82:Tc64,Found string "aES|L" (Indicator: "aes"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") file/memory contains long string with (Indicator: "base64"; File: "Web Data") file/memory contains long string with (Indicator: "aes"; File: "terminal64.sym") Found string "The Diffie-Hellman group is not compatible with the policy type." (Indicator: "diffie-hellman"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "\360NetBase64.dll" (Indicator: "base64"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found string "CHACHA20_POLY1305" (Indicator: "chacha"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "3DES-168" (Indicator: "3des"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "3DES-168" (Indicator: "3des-168"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "3DES-112" (Indicator: "3des"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "3DES-112" (Indicator: "3des-112"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "pkAES-128" (Indicator: "aes"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "pkAES-192" (Indicator: "aes"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "pkAES-256" (Indicator: "aes"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "Blowfish" (Indicator: "blowfish"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "Twofish" (Indicator: "twofish"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "CALG_3DES_112" (Indicator: "3des"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "CALG_3DES" (Indicator: "3des"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "CALG_AES_128" (Indicator: "aes"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "CALG_AES_192" (Indicator: "aes"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "CALG_AES_256" (Indicator: "aes"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "CALG_AES" (Indicator: "aes"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "CALG_ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "TLS_AES_256_GCM_SHA384" (Indicator: "aes"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "TLS_AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "TLS_CHACHA20_POLY1305_SHA256" (Indicator: "chacha"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "TLS_AES_128_CCM_8_SHA256" (Indicator: "aes"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp")83:Tc95,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "FSFindFirstFile" (Indicator: "FindFirstFile"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found reference to API "FSFindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found reference to API "FSFindNextFile" (Indicator: "FindNextFile"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found reference to API "FSFindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "FindFirstFileEx" (Indicator: "FindFirstFile"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "FindNextFile" (Indicator: "FindNextFile"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "FindFirstFile" (Indicator: "FindFirstFile"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp")84:T1048,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "Module32FirstW" (Indicator: "Module32First"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "Module32NextW" (Indicator: "Module32Next"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "00000000-00007916.00000000.163549.00B91000.00000020.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "NtGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtGetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtWow64GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtWow64QueryInformationProcess64" (Indicator: "QueryInformationProcess"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp")85:T8e0,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000001.165588.15430000.00000004.mdmp, 00000000-00002396.00000001.165588.16814000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.15430000.00000004.mdmp, 00000000-00002396.00000002.167507.16814000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.15430000.00000004.mdmp, 00000000-00002396.00000003.171537.16814000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp")86:T69a,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "SE_GetProcAddressForCaller" (Indicator: "GetProcAddress"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "LdrGetProcedureAddress" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "LdrGetProcedureAddressEx" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "LdrGetProcedureAddressForCaller" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000001.165588.15430000.00000004.mdmp, 00000000-00002396.00000001.165588.16814000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.15430000.00000004.mdmp, 00000000-00002396.00000002.167507.16814000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.15430000.00000004.mdmp, 00000000-00002396.00000003.171537.16814000.00000004.mdmp")87:T101c,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "00000000-00007916.00000000.163549.00B91000.00000020.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "NtQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "RtlGetCurrentDirectory_U" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "FSGetFileAttributes" (Indicator: "GetFileAttributes"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found reference to API "FSGetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp")88:T79a,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000001.165588.15430000.00000004.mdmp, 00000000-00002396.00000001.165588.16814000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.15430000.00000004.mdmp, 00000000-00002396.00000002.167507.16814000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.15430000.00000004.mdmp, 00000000-00002396.00000003.171537.16814000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp")89:T1523,Found string "The Windows password is too complex to be converted to a LAN Manager password. The LAN Manager password returned is a NULL string." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "When trying to update a password, this return status indicates that the value provided as the current password is not correct." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "When trying to update a password, this return status indicates that the value provided for the new password contains values that are not allowed in passwords." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "When trying to update a password, this status indicates that some password update rule has been violated. For example, the password may not meet length criteria." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "The user account's password has expired." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "You specified an incorrect password to a LAN Manager 2.x or MS-NET server." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "The maximum number of secrets that may be stored in a single system has been exceeded. The length and number of secrets is limited to satisfy United States State Department export restrictions." (Indicator: "secret"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "The length of a secret exceeds the maximum length allowed. The length and number of secrets is limited to satisfy United States State Department export restrictions." (Indicator: "secret"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "An attempt was made to change a user password in the security account manager without providing the necessary Windows cross-encrypted password." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "An attempt was made to change a user password in the security account manager without providing the necessary LM cross-encrypted password." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "The workstation does not have a trust secret for the primary domain in the local LSA database." (Indicator: "secret"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "The user's password must be changed before signing in." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "The password provided is too short to meet the policy of your user account. Please choose a longer password." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "You have attempted to change your password to one that you have used in the past. The policy of your user account does not allow this. Please select a password that you have not previously used." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "The password provided is too long to meet the policy of your user account. Please choose a shorter password." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "Mutual Authentication failed. The server's password is out of date at the domain controller." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "Security Account Manager needs to get the boot password." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "EAS policy requires that the user change their password before this operation can be performed." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "The local account store does not contain secret material for the specified account." (Indicator: "secret"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "The BitLocker startup key or recovery password could not be read from external media." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "The BitLocker startup key or recovery password file is corrupt or invalid." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "The BitLocker encryption key could not be obtained from the startup key or recovery password." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found string "Device Lock has been triggered due to too many incorrect password attempts." (Indicator: "password"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp")8a:T832,"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\QHSafeMain.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002396.00000001.165588.00DDB000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002396.00000001.165588.00DDB000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360sd.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002396.00000001.165588.00DDB000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360chrome.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002396.00000001.165588.00DDB000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\360Chrome" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002396.00000001.165588.00DDB000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360se6.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002396.00000001.165588.00DDB000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Safe.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002396.00000001.165588.00DDB000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\NetPurifier.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002396.00000001.165588.00DDB000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Send.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002396.00000001.165588.00DDB000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002396.00000001.165588.00DDB000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002396.00000001.165588.01512000.00000002.mdmp8b:T5d1,Found string "" (Indicator: ""; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "" (Indicator: ""; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp")8c:T94b,Found string "Bad hostname" (Indicator: "hostname"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "Hostname '%s' was found in DNS cache" (Indicator: "hostname"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "Hostname in DNS cache was stale, zapped" (Indicator: "hostname"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "Hostname in DNS cache doesn't have needed family, zapped" (Indicator: "hostname"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "Hostname %s was found in DNS cache" (Indicator: "hostname"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "Hostname '%s' was found" (Indicator: "hostname"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "SOCKS5: the destination hostname is too long to be resolved remotely by the proxy." (Indicator: "hostname"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "SOCKS5: hostname '%s' found" (Indicator: "hostname"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "aws-sigv4: service missing in parameters and hostname" (Indicator: "hostname"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "aws-sigv4: service too long in hostname" (Indicator: "hostname"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "aws-sigv4: region missing in parameters and hostname" (Indicator: "hostname"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "aws-sigv4: region too long in hostname" (Indicator: "hostname"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "schannel: connection hostname (%s) validated against certificate name (%s)" (Indicator: "hostname"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "schannel: connection hostname (%s) did not match against certificate name (%s)" (Indicator: "hostname"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found string "schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names" (Indicator: "hostname"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp")8d:T8e9,Found registry deletion API: "RegDeleteKeyW" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry deletion API: "RegDeleteValueW" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry deletion API: "SHDeleteKeyW" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry deletion API: "SHDeleteValueA" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry deletion API: "SHDeleteValueW" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry deletion API: "NtDeleteKey" in file "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin" Found registry deletion API: "NtDeleteKey" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp" Found registry deletion API: "NtDeleteValueKey" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp" Found registry deletion API: "RtlDeleteRegistryValue" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp" Found registry deletion API: "ZwDeleteKey" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp" Found registry deletion API: "ZwDeleteValueKey" in "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp" Found registry deletion API: "BRegDeleteKey" in "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp" Found registry deletion API: "BRegDeleteKeyW" in "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp" Found registry deletion API: "BRegDeleteValue" in "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp" Found registry deletion API: "BRegDeleteValueW" in "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp" Found registry deletion API: "SHDeleteValueW" in "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp" Found registry deletion API: "SHDeleteKeyW" in "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp" Found registry deletion API: "SHDeleteValueA" in "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp"8e:T813,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "NtDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "FSDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found reference to API "FSDeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "RemoveDirectory" (Indicator: "RemoveDirectory"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp")8f:T4ab,Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "SetWinEventHook" (Indicator: "SetWinEventHook"; Source: "00000000-00002396.00000001.165588.01512000.00000002.mdmp")90:T5f8,Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "RtlCheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwQueryInformationToken" (Indicator: "ZwQueryInformationToken"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.16814000.00000004.mdmp, 00000000-00002396.00000002.167507.16814000.00000004.mdmp")91:Ta09,Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "FSSetFileAttributes" (Indicator: "SetFileAttributes"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found reference to API "FSSetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000001.165588.0601F000.00000004.mdmp, 00000000-00002396.00000001.165588.16C93000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0559C000.00000004.mdmp, 00000000-00002396.00000002.167507.05CA0000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp")92:T6ea,Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp")93:T161b,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "NtAccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtAccessCheckAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheck"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheckByType"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeAndAuditAlarm" (Indicator: "AccessCheckByType"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheck"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheckByType"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheckByType"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheck"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheckByType"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtAllocateLocallyUniqueId" (Indicator: "AllocateLocallyUniqueId"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtDuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtImpersonateAnonymousToken" (Indicator: "ImpersonateAnonymousToken"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "NtPrivilegeCheck" (Indicator: "PrivilegeCheck"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp")94:T9ff,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00007916.00000000.163549.00B91000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "ZwTerminateProcess"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp")95:T513,Found reference to API "WriteFile" (Indicator: "WriteFile"; File: "739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00001008.00000000.164430.0135D000.00000002.mdmp, 00000000-00001008.00000001.164707.0135D000.00000002.mdmp") Found reference to API "NtWriteFile" (Indicator: "NtWriteFile"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "ZwWriteFile" (Indicator: "ZwWriteFile"; Source: "00000000-00001008.00000001.164707.04DFE000.00000004.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000001.165588.15430000.00000004.mdmp, 00000000-00002396.00000001.165588.16814000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.15430000.00000004.mdmp, 00000000-00002396.00000002.167507.16814000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.15430000.00000004.mdmp, 00000000-00002396.00000003.171537.16814000.00000004.mdmp")96:Te69," "------4ad1292fc1f888bde8a9Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-34090EC------4ad1292fc1f888bde8a9Content-Disposition: form-data; name="build_id"0ed23b7275484723da2d483995b52b7c------4ad1292fc1f888bde8a9Content-Disposition: form-data; name="format"json------4ad1292fc1f888bde8a9--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Fri 05 Jun 2026 21:03:36 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST /componentupdater/api/v1/update?cup2key=7:pTAcclTE9Orc_eFFrnU_YcbFKFr1jlYKrfS2Id_gbr8&cup2hreq=f1a86316958bb6ccd6a36539d591d40b8f257aa8b2d4edb9c869c68cd8c8b692 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Content-Length: 11728 X-Microsoft-Update-AppId: eeobbhfgfagbclfofmgbdfoicabjdbkn,pghocgajpebopihickglahgebcmkcekh,oankkpibpaokgecfckkdkgaoafllipag,kpfehajjjbbcifeehjgfgnabifknmdad,ohckeflnhegojcjlcpbfpciadgikcohk,fppmbhmldokgmleojlplaaodlkibgikh,ndikpojcjlepofdkaaldkinkjbeeebkl,laoigpblnllgcgjnjnllmfolckpjlhki,efniojlnjndmcbiieegkicadnoecjjef,fgbafbciocncjfbbonhocjaohoknlaco,mpicjakjneaggahlnmbojhjpnileolnb,ojblfafjmiikbkepnnolpgbbhejhlcim,jbfaflocpnkhbgcijpkiafdpbjkedane,gllimckfbolmioaaihpppacjccghejen,kmkacjgmmfchkbeglfbjjeidfckbnkca,llmidpclgepbgbgoecnhcmgfhmfplfao,cllppcmmlnkggcmljjfigkcigaajjmid,ahmaebgpfccdhgidjaidaoojjcijckba,lkkdlcloifjinapabfonaibjijloebfb,plbmmhnabegcabfbcejohgjpkamkddhn,mkcgfaeepibomfapiapjaceihcojnphg,jcmcegpcehdchljeldgmmfbgcpnmgedo,hjaimielcgmceiphgjjfddlgjklfpdei,pbdgbpmpeenomngainidcjmopnklimmf,lfmeghnikdkbonehgjihjebgioakijgn X-Microsoft-Update-Interactivity: bg X-Microsoft-Update-Service-Cohort: 5102 X-Microsoft-Update-Updater: msedge-145.0.3800.58 Content-Type: application/json Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 X-Client-Data: CPn8ygE= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd" with payload::==> "{"request":{"@os":"win","@updater":"msedge","acceptformat":"crx3 download run xz zucc","apps":[{"appid":"eeobbhfgfagbclfofmgbdfoicabjdbkn","brand":"GGLS","cached_items":[{"sha256":"000ac7dc9366969db9d1e41810a3a27c747a7623535d856eecc2de86cfed80c7"}],"cohort":"rrf@0.07","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.07","AppMajorVersion":"145","AppRollout":0.07,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"1.0.0.10"},{"appid":"pghocgajpebopihickglahgebcmkcekh","brand":"GGLS","cached_items":[{"sha256":"89f43cb3df807293de2772d5f01ac2fc1482b38ccc8fdaee859b80642b7a0487"}],"cohort":"rrf@0.05","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.05","AppMajorVersion":"145","AppRollout":0.05,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"3.0.0.16"},{"appid":"oankkpibpaokgecfckkdkgaoafllipag","brand":"GGLS","cached_items":[{"sha256":"fa29a6d5775ff340900a65b39b02fc8b4b77d403c048d8debf22f2f5d09c61a0"}],"cohort":"rrf@0.65","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.65","AppMajorVersion":"145","AppRollout":0.65,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"6498.2025.9.4"},{"appid":"kpfehajjjbbcifeehjgfgnabifknmdad","brand":"GGLS","cohort":"rrf@0.14","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.14","AppMajorVersion":"145","AppRollout":0.14,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"0.0.0.0"},{"appid":"ohckeflnhegojcjlcpbfpciadgikcohk","brand":"GGLS","cached_items":[{"sha256":"95fd9d48e4fc245a3f3a99a3a16ecd1355050ba3f4afc555f19a97c7f9b49677"}],"cohort":"rrf@0.55","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.55","AppMajorVersion":"145","AppRollout":0.55,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"0.0.1.7"},{"appid":"fppmbhmldokgmleojlplaaodlkibgikh","brand":"GGLS","cohort":"rrf@0.19","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.19","AppMajorVersion":"145","AppRollout":0.19,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"0.0.0.0"},{"appid":"ndikpojcjlepofdkaaldkinkjbeeebkl","brand":"GGLS","cohort":"rrf@0.09","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.09","AppMajorVersion":"145","AppRollout":0.09,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"0.0.0.0"},{"appid":"laoigpblnllgcgjnjnllmfolckpjlhki","brand":"GGLS","cohort":"rrf@0.38","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.38","AppMajorVersion":"145","AppRollout":0.38,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"1.0.7.1652906823"},{"appid":"efniojlnjndmcbiieegkicadnoecjjef","brand":"GGLS","cohort":"rrf@0.25","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.25","AppMajorVersion":"145","AppRollout":0.25,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"0.0.0.0"},{"appid":"fgbafbciocncjfbbonhocjaohoknlaco","brand":"GGLS","cached_items":[{"sha256":"fbb2c0f4fad3b34b3ac7116d98f83638cf6f55a47992026a7abf944a759aa0ea"}],"cohort":"rrf@0.93","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.93","AppMajorVersion":"145","AppRollout":0.93,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"2025.9.29.1"},{"appid":"mpicjakjneaggahlnmbojhjpnileolnb","brand":"GGLS","cached_items":[{"sha256":"e0770b8d8d69ebb2a2be543d8ab5c90514db12c2c9812c1399a3f61983f8c0ed"}],"cohort":"rrf@0.49","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.49","AppMajorVersion":"145","AppRollout":0.49,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"4.0.1.30"},{"appid":"ojblfafjmiikbkepnnolpgbbhejhlcim","brand":"GGLS","cohort":"rrf@0.48","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.48","AppMajorVersion":"145","AppRollout":0.48,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"4.10.2934.0"},{"appid":"jbfaflocpnkhbgcijpkiafdpbjkedane","brand":"GGLS","cohort":"rrf@0.39","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.39","AppMajorVersion":"145","AppRollout":0.39,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"1.0.0.36"},{"appid":"gllimckfbolmioaaihpppacjccghejen","brand":"GGLS","cached_items":[{"sha256":"8d64e3a35ee2c3e0b9e33afd63069fdc917a5647dd1e20c5ead97955fb6979f9"}],"cohort":"rrf@0.23","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.23","AppMajorVersion":"145","AppRollout":0.23,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"1.2.0.0"},{"appid":"kmkacjgmmfchkbeglfbjjeidfckbnkca","brand":"GGLS","cached_items":[{"sha256":"4a84f2bdd63dabe6abde22b9047a6942eeb7bdf93d8435cc4b188dbe72d9e30d"}],"cohort":"rrf@0.75","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.75","AppMajorVersion":"145","AppRollout":0.75,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"2.0.0.0"},{"appid":"llmidpclgepbgbgoecnhcmgfhmfplfao","brand":"GGLS","cohort":"rrf@0.99","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.99","AppMajorVersion":"145","AppRollout":0.99,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"0.0.0.0"},{"appid":"cllppcmmlnkggcmljjfigkcigaajjmid","brand":"GGLS","cohort":"rrf@0.58","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.58","AppMajorVersion":"145","AppRollout":0.58,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"0.0.0.0"},{"appid":"ahmaebgpfccdhgidjaidaoojjcijckba","brand":"GGLS","cached_items":[{"sha256":"07e0ad6da3d30a27962c6e09da9798ba1745856eaad71a036e2f639e93ea0b27"}],"cohort":"rrf@0.06","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.06","AppMajorVersion":"145","AppRollout":0.06,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"3.2.0.0"},{"appid":"lkkdlcloifjinapabfonaibjijloebfb","brand":"GGLS","cached_items":[{"sha256":"c039d4b6c356d706a3251f7b89293840c0d8e845def2b28056762aa55a235b60"}],"cohort":"rrf@0.32","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.32","AppMajorVersion":"145","AppRollout":0.32,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"4.0.4.0"},{"appid":"plbmmhnabegcabfbcejohgjpkamkddhn","brand":"GGLS","cached_items":[{"sha256":"1e1174204f8a0a13de2e224a1be882d2724a6fd13ba18a895fd5098fd5552460"}],"cohort":"rrf@0.74","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.74","AppMajorVersion":"145","AppRollout":0.74,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"3057"},{"appid":"mkcgfaeepibomfapiapjaceihcojnphg","brand":"GGLS","cohort":"rrf@0.50","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.50","AppMajorVersion":"145","AppRollout":0.5,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"0.0.0.0"},{"appid":"jcmcegpcehdchljeldgmmfbgcpnmgedo","brand":"GGLS","cached_items":[{"sha256":"4ac10c6a2a59ba8c203b12ad37a79e0f6349fadad4d0af3240dcd3c3b9377344"}],"cohort":"rrf@0.84","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.84","AppMajorVersion":"145","AppRollout":0.84,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"2026.2.1.1"},{"appid":"hjaimielcgmceiphgjjfddlgjklfpdei","brand":"GGLS","cached_items":[{"sha256":"a00289af85d31d698a0f6753b6ce67dbab4bdff639bde5fc588a5d5d8a3885d5"}],"cohort":"rrf@0.04","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.04","AppMajorVersion":"145","AppRollout":0.04,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"1.0.0.5"},{"appid":"pbdgbpmpeenomngainidcjmopnklimmf","brand":"GGLS","cached_items":[{"sha256":"b27bec7581505715364f132de1998818c82462dbf55a1f55f9b15e29e988d791"}],"cohort":"rrf@0.10","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.10","AppMajorVersion":"145","AppRollout":0.1,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"0.0.0.46"},{"appid":"lfmeghnikdkbonehgjihjebgioakijgn","brand":"GGLS","cached_items":[{"sha256":"e8ecb70a4c65bb099de40a99a4892b6758ac85d46caac82870b6adb6573466d9"}],"cohort":"rrf@0.20","enabled":true,"installdate":-1,"lang":"en-US","ping":{"r":-2},"targetingattributes":{"AppCohort":"rrf@0.20","AppMajorVersion":"145","AppRollout":0.2,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false,"Updater":"Omaha","UpdaterVersion":"1.3.221.3"},"updatecheck":{},"version":"2.0.0.143"}],"arch":"x64","dedup":"cr","domainjoined":false,"hw":{"avx":1,"physmemory":8,"sse":1,"sse2":1,"sse3":1,"sse41":1,"sse42":1,"ssse3":1},"ismachine":1,"os":{"arch":"x86_64","platform":"Windows","version":"10.0.16299.248"},"prodversion":"145.0.3800.58","protocol":"4.0","requestid":"{9eff01d8-6b15-4778-b8b4-494dbeead038}","sessionid":"{a9044887-4619-4a93-9782-e3baa1a3fe7e}","updaters":{"autoupdatecheckenabled":true,"ismachine":1,"lastchecked":1344,"laststarted":1344,"name":"Omaha","updatepolicy":-1,"version":"1.3.221.3"},"updaterversion":"145.0.3800.58"}}" HTTP/1.1 200 OK Cache-Control: no-store must-revalidate no-cache max-age=0 Pragma: no-cache Content-Length: 4180 Content-Type: application/json Content-Encoding: gzip Expires: Mon 01 Jan 1990 00:00:00 GMT ETag: 304402207F4BDBFEAD5B45147BAD9BF0CD74A56C9FAC1888FB9CBB9A9F9B16E9B1F875C202205E709F4A99A5D250D3D3643FE1C42DEF97F0FBBF045764D1D84E9D07CCAAFFAB:f1a86316958bb6ccd6a36539d591d40b8f257aa8b2d4edb9c869c68cd8c8b692 X-FALCON-REF: Ref A: 0A98FC52FD8C4BC79761DE42535B3A2A Ref B: SC-EUS2-F44GI_AKS-GEN00-42658871-VMSS00000O_FABRICROUTER-AZUREGLOBALPRIVATE-7B6F57BCF4-WWQC5 Ref C: 2026-06-05T21:05:09Z X-Falcon-RouterStatusCode: SuccessfullyForwarded (200) X-Frame-Options: sameorigin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block x-cup-server-proof: 304402207F4BDBFEAD5B45147BAD9BF0CD74A56C9FAC1888FB9CBB9A9F9B16E9B1F875C202205E709F4A99A5D250D3D3643FE1C42DEF97F0FBBF045764D1D84E9D07CCAAFFAB:f1a86316958bb6ccd6a36539d591d40b8f257aa8b2d4edb9c869c68cd8c8b692 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 0A98FC52FD8C4BC79761DE42535B3A2A Ref B: CO1AA3060814042 Ref C: 2026-06-05T21:05:09Z Date: Fri 05 Jun 2026 21:05:09 GMT with response body ==>295D7D270A7B22726573706F6E7365223A7B22736572766572223A2270726F64222C2270726F746F636F6C223A22342E30222C226461797374617274223A7B22....... "POST /Telemetry.Request HTTP/1.1 Connection: Keep-Alive Content-Type: application/xml User-Agent: Crashpad/0.8.0 WinHTTP/10.0.16299.192 Windows_NT/10.0.16299.15 (x64) MSA_DeviceTicket: eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZGs3Zjd1UkZidUd5R1FaVllST1dpV2lnTUs0R2lNbGxiaGJRVzk0UDRFUSIsInppcCI6IkRFRiJ9..x2hxvUUnR3egnlIub7W7_w.5Z9Wxptm_VpfNLxVG94m9xFP3cqwB_tuk1c5rKiHFucCR7MoT-tSQ76gbcQG13Ae-rYR_RHwY6zVTnBJh4gxb8PZQaCcV1nEBIfov_-fPjNa0ThKPpm6UQ14e6fMn-3Fuu5I9B3OEenwCaVEKkfyiugVKcQKvXqoJiMklGFRN41YTr2OwZK255mN-ClGHXMsHOP5WhgwedzW26ix4BuWAH9sMVKkGd8ilwZUeaRLEUGxQKyLd5KJhrXatG4V3RnvOSD9fRQeUKOfNWpelOg_o5Tn9hxl_t5D3L7kVTU5I1VCdRq0btIWypNzESA-uotl5_owHwYGkBRflFFRLRyV0XCLvrjLP7kdVWL3HixIdcVTdU37rt795QBlTQIVfYuvs7hefBRTVcRw3CyoVCzed4BfpnNbOk3er4vLe4R3tvjva40uAfUhIKNxtcg52DO_vs2QYeDEr8_uSveivemSjpYingi3ODqRiW1t4kS-hQqc_-tu47ZPNOu9YSGducZ_aVdif0wv3lbKE9gGpql2JQ9hH_iMFatrXrC6Y4yyz-qWMPRFxcmaQNhB6rlGE-EbP1WX8_QUDfriaaS-0E3IXFfLKTBzOGoHMTs06REjMM7WlUvMpBLvzp7XdE35UM7g6B5ed6szp57s0EdmEG_pcF2E8JQaOZvDnM5v_zvDn7zS8FOnjL-kDD3wcdS5YDk8Hyw81uBL8hobwWrfX00to-3oFm6DzLBKKQX0UhdREVQPcXyuE31afPZg5OYJG8W6-cERwJkg4dKTDRl5i01aOzG9SURirOsSe8kzDCDpJkxp_ncnC2mGcumhvmh4LhHRLgmbizl1BrHS63thYTLRiU7fic8kaMftQYYQNjyqhzySI7uP2uCuKunaUm4u5sBJi9RbBLZN8Dt--9wENNl-NbgXEUC7WRciUJPLs0aQqqDk44lCV8wFKEf7whlKyGeCYGdBdgP4NtSDyx0TwRjfEnRH3zN7An0eDRPvtTbevIykHn4wvyeCSeD1hN_p4Vt_iBPm8Ihbd6eEFc4V4e_iJA0mCDlUAje8iFA1v12VEaa3mjWHw7rg665x2rhACcSD-uKxPhSjCYQU9qKRNakd8-w5mtzmFBK_m59go67HjDLVgisFs_1rqZ4ZevDv0gRV4bqxnvaHAeQtX41QNFu9MrSz3qxuWUD4wSR48diJi5oBYCuZHEGjbsI233-eKrADx0ETYoxNpyZX4ja9vB8ylxIfmjHUA0vk-Ug2rEMQ_zDrMag4q_v8jNo6wsrQcJ28qquXIqQ0nRh08ANrUgbrlxwJOARVGFsqZecxSGhX2GM.-aBABYApDNRWOv3SZQTUuBM0nMEI0E87D-Q-4kVVIW0 Content-Length: 3767 Host: nw-umwatson.events.data.microsoft.com" with payload::==> "³ " HTTP/1.1 200 200 OK Content-Length: 631 Content-Type: text/xml Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Date: Fri 05 Jun 2026 21:05:29 GMT with response body ==>3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D38223F3E3C72657370207665723D2232223E3C746C6D3E3C72657370733E....... "POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard&laf=b64bin HTTP/2 Host: accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Cookie: NID=528=QhXUdaTzjFrMXE02QLVt1k2WiA2ynA_Ouitn5zVri5chg-ukoTgYHQqPwZlXVkdBvNMB26_e5gW-W6OVoS55ZRjtV0CyjY4CIiVzvFX2jlGZQ50u3H4wQZnvLRINRlqJzGWs5mxNAW9YngPdKM-e4oqI5XZZmCqH7FiypPa4aKfkIazg9A5hLQfxLf0kwtWx7tWlSSitigNSTN50bRnL1UQpfMkcsvKaFjs Origin: https://www.google.com Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "504F5354202F4C6973744163636F756E74733F67707369613D3126736F757263653D4368726F6D69756D42726F77736572266A736F6E3D7374616E64617264266C61663D62363462696E20485454502F320A486F73743A206163636F756E74732E676F6F676C652E636F6D0A557365722D4167656E743A204D6F7A696C6C612F352E30202857696E646F7773204E542031302E303B2057696E36343B2078363429204170706C655765624B69742F3533372E333620284B48544D4C2C206C696B65204765636B6F29204368726F6D652F3134342E302E302E30205361666172692F3533372E33360A436F6E74656E742D547970653A206170706C69636174696F6E2F782D7777772D666F726D2D75726C656E636F6465640A5365632D46657463682D4D6F64653A206E6F2D636F72730A5365632D46657463682D536974653A206E6F6E650A4163636570742D4C616E67756167653A20656E2D55532C656E3B713D302E390A436F6F6B69653A204E49443D3532383D516858556461547A6A46724D58453032514C5674316B3257694132796E415F4F7569746E357A567269356368672D756B6F54675948517150775A6C58566B6442764E4D4232365F653567572D57364F566F5335355A526A74563043796A5934434969567A764658326A6C475A5135307533483477515A6E764C52494E526C714A7A475773356D784E415739596E6750644B4D2D65346F714935585A5A6D4371483746697970506134614B666B49617A67394135684C5166784C66306B777457783774576C5353697469674E53544E353062526E4C31555170664D6B6373764B61466A730A4F726967696E3A2068747470733A2F2F7777772E676F6F676C652E636F6D0A5072696F726974793A20753D342C20690A4163636570742D456E636F64696E673A20677A69702C206465666C6174652C2062722C207A7374640A5365632D46657463682D446573743A20656D7074790A" HTTP/2 200 OK Content-Type: application/binary Date: Fri 05 Jun 2026 21:03:54 GMT Server: ESF Expires: Mon 01 Jan 1990 00:00:00 GMT Vary: Origin Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factors=* ch-ua-platform=* ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin P3p: CP="This is not a P3P policy! See g.co/p3phelp for more info." Pragma: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factors Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Access-Control-Allow-Origin: https://www.google.com Set-Cookie: NID=531=P6t00OzixpaDlutu9nT4XbDiPB2SDZhWXzBw0GoKrUUFhUrvGMGWNujklmb4GyHi4aq22XW--ApbfbPDKxaBmVr1eIB5bWZtBZfQkORZ-SPc4QM7IU8P7kJBlxXK3PKp2evXWdkqelrQkTj0_YKYwZRSpoczNyWxvvmNlL1T8GJVQrIkVz0Q9UVipO7bH2ndcYznYdJIAoBBYBRHO_rxCBZNgPKo-gELv56qkg; expires=Sat 05-Dec-2026 21:03:54 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Reporting-Endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjUtHikmII0JBiOHxtB5Meyy0mIyDW1PNl0wVi84n-bNZALMTDsetzz0U2gQcfd3xmVNJNyi-Mz0xJzSvJLKnMySwuSUxOzi_NKykuTi0qSy2KNzIwMjMwNTbUMzCOLzAAAOnaIGo" Access-Control-Allow-Credentials: true Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data:;report-uri /_/IdentityListAccountsHttp/cspreport/fine-allowlist X-Xss-Protection: 0 X-Content-Type-Options: nosniff Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with no response body "POST /checkin HTTP/2 Host: android.clients.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-protobuf Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "BINARY_CONTENT" HTTP/2 200 OK Content-Type: application/x-protobuffer Date: Fri 05 Jun 2026 21:03:56 GMT Server: ESF Expires: Mon 01 Jan 1990 00:00:00 GMT Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Permissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factors=* ch-ua-platform=* ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Pragma: no-cache Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factors Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /checkin/_/AndroidCheckinHttp/cspreport X-Xss-Protection: 0 X-Content-Type-Options: nosniff Cache-Control: no-cache no-store max-age=0 must-revalidate Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "POST /v1:GetModels?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/2 Host: optimizationguide-pa.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-protobuf Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none X-Client-Data: CN7cygE= Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "n 2h atype.googleapis.com/google.privacy.webpermissionpredictions.v1.WebPermissionPredictionsClientInfo e 2_ Wtype.googleapis.com/google.internal.chrome.optimizationguide.v1.PageTopicsModelMetadata0 g 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ n 2h atype.googleapis.com/google.privacy.webpermissionpredictions.v1.WebPermissionPredictionsClientInfo g 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ g 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ l 2f `type.googleapis.com/google.internal.chrome.optimizationguide.v1.AutocompleteScoringModelMetadata g 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ + g- 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ g. 2a Ytype.googleapis.com/google.internal.chrome.optimizationguide.v1.SegmentationModelMetadataJ*en-US2" HTTP/2 200 OK Content-Type: application/x-protobuf Date: Fri 05 Jun 2026 21:04:02 GMT Server: ESF Content-Disposition: attachment X-Xss-Protection: 0 X-Content-Type-Options: nosniff Vary: Referer Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "POST /c2dm/register3 HTTP/2 Host: android.clients.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Authorization: AidLogin 5128682385002746151:4090087931532893237 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "app=com.google.android.gms&device=5128682385002746151&sender=745476177629" HTTP/2 301 Moved Permanently Content-Type: text/plain; charset=UTF-8 Date: Fri 05 Jun 2026 21:05:06 GMT Server: GSE Expires: Fri 05 Jun 2026 21:05:06 GMT Content-Security-Policy: frame-ancestors 'self' X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Cache-Control: private max-age=0 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "POST /chromewebstore/v1.1/items/verify HTTP/2 Host: www.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Content-Type: application/json Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "{"hash":"HRejyuEX3m9//YfJTap++mU7WrE2lEH6e3YnxSoKcQk=","ids":["ghbmnnjooekpmoecnnnilnnbdlolhkhi"],"protocol_version":1}" HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Fri 05 Jun 2026 21:05:11 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff Vary: Referer Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT.......9c:T606,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002396.00000001.165588.00F90000.00000004.mdmp, 00000000-00002396.00000002.167507.00F90000.00000004.mdmp, 00000000-00002396.00000003.171537.00F90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform remote procedure calls (API string)","description":"Found reference to API \"RpcStringFreeW\" (Indicator: \"RpcStringFree\"; File: \"739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-160","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00001008.00000001.164707.04DFE000.00000004.mdmp\")\n Found reference to API \"NtUnmapViewOfSectionEx\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00001008.00000001.164707.04DFE000.00000004.mdmp\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00001008.00000001.164707.04DFE000.00000004.mdmp\")\n Found reference to API \"ZwUnmapViewOfSectionEx\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00001008.00000001.164707.04DFE000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$2f","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$30","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$31","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$32","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00007876]\n Process \"WerFault.exe\" [UID: 00000000-00008168]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"RadiantForg.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00007916.00000000.163549.00B91000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$33","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$34","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp\")\n Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000001.165588.15430000.00000004.mdmp, 00000000-00002396.00000001.165588.16814000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.15430000.00000004.mdmp, 00000000-00002396.00000002.167507.16814000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.15430000.00000004.mdmp, 00000000-00002396.00000003.171537.16814000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertGetNameStringW\" (Indicator: \"CertGetNameString\"; File: \"739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99718","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$35","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$36","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"$38","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"$39","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\360Chrome\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002396.00000001.165588.00DDB000.00000002.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002396.00000001.165588.00DDB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002396.00000001.165588.00DDB000.00000002.mdmp\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"file/memory contains long string with (Indicator: \"moz_cookies\"; File: \"xnZCSMmL6r\")\n Found string \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"00000000-00002396-00000C3C-129688632683\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoExCancel\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp\")\n Found reference to API \"GetAddrInfoExW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp\")\n Found reference to API \"getaddrinfo(3) failed for %s:%d\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"setupdigetdeviceregistryproperty\"; File: \"739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"setupdienumdeviceinfo\"; File: \"739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin\")\n Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"setupdigetclassdevs\"; File: \"739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"739eba9ecc9a6eef0cfeb0314caeb0b5e9c6382d22c9e1b017aad70bee3c580e.bin\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002396.00000001.165588.00DDB000.00000002.mdmp, 00000000-00002396.00000001.165588.01512000.00000002.mdmp, 00000000-00002396.00000001.165588.0158B000.00000004.mdmp, 00000000-00002396.00000002.167507.0158B000.00000004.mdmp, 00000000-00002396.00000003.171537.0158B000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002396.00000001.165588.01512000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the current system language","description":"Found reference to API \"NtQueryDefaultUILanguage\" (Indicator: \"ntquerydefaultuilanguage\"; Source: \"00000000-00001008.00000001.164707.04DFE000.00000004.mdmp\")\n Found reference to API \"NtQueryInstallUILanguage\" (Indicator: \"ntqueryinstalluilanguage\"; Source: \"00000000-00001008.00000001.164707.04DFE000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-737","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the system language code","description":"Found reference to API \"NtQueryDefaultUILanguage\" (Indicator: \"NtQueryDefaultUILanguage\"; Source: \"00000000-00001008.00000001.164707.04DFE000.00000004.mdmp\")\n Found reference to API \"NtQueryInstallUILanguage\" (Indicator: \"NtQueryInstallUILanguage\"; Source: \"00000000-00001008.00000001.164707.04DFE000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-837","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"NexusGenera.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006820)\n \"RadiantForg.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002396)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\" \"------4ad1292fc1f888bde8a9Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-34090EC------4ad1292fc1f888bde8a9Content-Disposition: form-data; name=\"build_id\"0ed23b7275484723da2d483995b52b7c------4ad1292fc1f888bde8a9Content-Disposition: form-data; name=\"format\"json------4ad1292fc1f888bde8a9--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"RadiantForg.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\COINOMI\\COINOMI\\WALLETS\"\n \"RadiantForg.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ELECTRUM\\WALLETS\"\n \"RadiantForg.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\EXODUS\\EXODUS.WALLET\"\n \"RadiantForg.exe\" trying to touch file \"%LOCALAPPDATA%\\COINOMI\\COINOMI\\WALLETS\"\n \"RadiantForg.exe\" trying to touch file \"%APPDATA%\\ELECTRUM\\WALLETS\"\n \"RadiantForg.exe\" trying to touch file \"%APPDATA%\\EXODUS\\EXODUS.WALLET\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$a2","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6a2339424cc5cd875907e376"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"