26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 64:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample 326c0d2bbb49… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 326c0d2bbb49…. Malware family: Crifi.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9"],"about":{"@type":"SoftwareApplication","name":"57b771acfadc050eeafeda8a628dae30.exe","applicationCategory":["peexe","executable"],"identifier":"326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":12,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5f9,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")28:T4e9,"" (Indicator: "RegSetValue"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp")2e:T412,Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")2f:T7e2,"" (Indicator: "enumchildwindows"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")35:T201e,"" in "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp" Found registry modification API: "" in "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp" Found registry modification API: "" in "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp" Found registry modification API: "" in "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp" Found registry modification API: "" in "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp" Found registry modification API: "" in "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp" Found registry modification API: "" in "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp" Found registry modification API: "" in "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp" Found registry modification API: "" in "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp" Found registry modification API: "" in "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp" Found registry modification API: "" in "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp" Found registry modification API: "" in "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp" Found registry modification API: "" in "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp" Found registry modification API: "" in "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp" Found registry modification API: "" in "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp" Found registry modification API: "" in "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp" Found registry modification API: "" in "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp" Found registry modification API: "" in "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp" Found registry modification API: "" in "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp" Found registry modification API: "" in "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp"3a:T1216,Found string "" (Indicator: "MoveFileA"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp")3b:Tcc7,"" (Indicator: "CreateProcess"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000000.129710.00870000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.00870000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "BasepConstructSxsCreateProcessMessage" (Indicator: "CreateProcess"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API "BasepReleaseSxsCreateProcessUtilityStruct" (Indicator: "CreateProcess"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004364.00000000.129600.00A50000.00000004.mdmp, 00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp")3e:Td18,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp")3f:T17e09,Found reference to API (Indicator: "RegDeleteValueA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "RegOpenKeyExA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "FreeSid"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "RegCreateKeyExA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "RegQueryValueExA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "EqualSid"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "RegSetValueExA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "OpenProcessToken"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "RegCloseKey"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetTokenInformation"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetDeviceCaps"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "TerminateProcess"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "LocalAlloc"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetTickCount"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetModuleFileNameA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetShortPathNameA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "CreateThread"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GlobalLock"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "TerminateThread"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SetFileAttributesA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetVersionExA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "WriteFile"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "CreateDirectoryA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetVersion"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "FreeLibrary"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetExitCodeProcess"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetStartupInfoW"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "CreateFileA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SizeofResource"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "ResetEvent"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SetEvent"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SetFilePointer"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "lstrcmpA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "DeleteFileA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "FindNextFileA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "LoadLibraryExA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "FindFirstFileA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "FreeResource"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetFileAttributesA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetLastError"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "ReadFile"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "CloseHandle"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "FindResourceA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "FormatMessageA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GlobalAlloc"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "CreateMutexA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GlobalUnlock"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetTempFileNameA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetProcAddress"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "LockResource"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GlobalFree"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "RemoveDirectoryA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "Sleep"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SetFileTime"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "CreateProcessA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetDriveTypeA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetTempPathA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "CompareStringA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "LoadResource"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "MulDiv"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "CreateEventA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "LocalFree"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetVolumeInformationA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "ExitProcess"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "FindClose"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SetForegroundWindow"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "CallWindowProcA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "MessageBoxA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "CharUpperA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SetWindowLongA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetSystemMetrics"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "MessageBeep"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "ExitWindowsEx"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SetWindowTextA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetDC"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "DispatchMessageA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "LoadStringA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "EnableWindow"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "PeekMessageA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SendMessageA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "ShowWindow"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "CharPrevA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetDesktopWindow"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SetWindowPos"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "CharNextA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetWindowRect"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "ReleaseDC"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetWindowLongA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "VerQueryValueA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "CheckTokenMembership"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "HeapSetInformation"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "DecryptFileA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SHBrowseForFolder"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "LocaleNameToLCID"; File: "00000000-00002216.00000000.129710.00D01000.00000020.mdmp") Found reference to API (Indicator: "InitializeAcl"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "IsValidAcl"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "TlsAlloc"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "LCMapStringW"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "CompareStringW"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "InitializeSListHead"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetCommandLineW"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetACP"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "HeapAlloc"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetModuleHandleExW"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "LoadLibraryExW"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "DecodePointer"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "RaiseException"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetCommandLineA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "HeapFree"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "FlushFileBuffers"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SetStdHandle"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetFileType"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "CreateFileW"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetConsoleMode"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "TlsFree"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "FindNextFileW"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetCPInfo"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "HeapSize"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "FindFirstFileExW"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "RtlUnwind"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetOEMCP"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "TlsGetValue"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "WriteConsoleW"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "ExitThread"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetStdHandle"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "EncodePointer"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "TlsSetValue"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SetFilePointerEx"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetStringTypeW"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetExitCodeThread"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetModuleFileNameW"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SetLastError"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "IsValidCodePage"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetFileSizeEx"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "HeapCreate"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetModuleHandleA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "VirtualFree"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "HeapDestroy"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "LCMapStringA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetStartupInfoA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SetHandleCount"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "GetStringTypeA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "SetEndOfFile"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "ShellExecuteExA"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API (Indicator: "BaseCleanupAppcompatCacheSupport"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetFirmwareEnvironmentVariableExA"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetFirmwareEnvironmentVariableExW"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetCompressedFileSizeTransactedA"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "ConvertNLSDayOfWeekToWin32DayOfWeek"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "AddIntegrityLabelToBoundaryDescriptor"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetPhysicallyInstalledSystemMemory"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "BasepFreeActivationContextActivationBlock"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "RemoveLocalAlternateComputerNameA"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "CreateMemoryResourceNotification"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessVersion"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetLongPathNameTransactedA"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessorSystemCycleTime"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessShutdownParameters"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetNumberFormatEx"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetProfileSectionW"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHandleCount"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionA"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessWorkingSetSize"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessPriorityBoost"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessWorkingSetSizeEx"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetNumaAvailableMemoryNode"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetProfileSectionA"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionW"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessIoCounters"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp") Found reference to API (Indicator: "IsValidAcl"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API (Indicator: "RemoveLocalAlternateComputerNameW"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSemaphoreWhenCallbackReturns"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSectionWhenCallbackReturns"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "RegisterApplicationRecoveryCallback"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "DisassociateCurrentThreadFromCallback"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "QueryIdleProcessorCycleTimeEx"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "ResolveLocaleName"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutexWhenCallbackReturns"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "ReadConsoleOutputCharacterW"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "NeedCurrentDirectoryForExePathA"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004364.00000001.131521.00E71000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004364.00000001.131521.00E71000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004364.00000001.131521.00E71000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00004364.00000001.131521.00E71000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004832.00000002.133494.00F81000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004832.00000002.133494.00F81000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004832.00000002.133494.00F81000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00004832.00000002.133494.00F81000.00000020.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00006816.00000000.129519.00BE1000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00006816.00000000.129519.00BE1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00006816.00000000.129519.00BE1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00006816.00000000.129519.00BE1000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")40:T52c,Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp")41:Tad0,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "LockResource" (Indicator: "LockResource"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")42:T12b6,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp")43:T5e6,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") file/memory contains long string with (Indicator: "OpenProcess"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")44:T4ab,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")45:Td89,"" (Indicator: "GetDC"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")4d:Tda1,Found registry query API: "RegOpenKeyExA" in file "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin" Found registry query API: "RegQueryValueExA" in file "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin" Found registry query API: "RegQueryInfoKeyA" in file "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin" Found registry query API: "" in "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp" Found registry query API: "" in "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp" Found registry query API: "" in "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp" Found registry query API: "" in "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp" Found registry query API: "" in "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp" Found registry query API: "" in "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp" Found registry query API: "" in "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp" Found registry query API: "" in "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp" Found registry query API: "" in "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp" Found registry query API: "" in "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp"4e:T77e,Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")4f:Te7d,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")50:T578,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")51:T7d5,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")52:T1047,Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")53:T6d8,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")54:Ta65,Found registry deletion API: "RegDeleteValueA" in file "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin" Found registry deletion API: "" in "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp" Found registry deletion API: "" in "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp" Found registry deletion API: "" in "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp" Found registry deletion API: "" in "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp" Found registry deletion API: "" in "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp" Found registry deletion API: "" in "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp" Found registry deletion API: "" in "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp" Found registry deletion API: "" in "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp" Found registry deletion API: "" in "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp" Found registry deletion API: "" in "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp"55:T481,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") file/memory contains long string with (Indicator: "OpenProcess"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") file/memory contains long string with (Indicator: "OpenProcess"; File: "Qo8RZ34.exe") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")56:Tc2d,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP002.TMP\1qF29QN9.exe" (Indicator: "\Device\"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found string "INDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP000.TMP\wK4CI45.exe" (Indicator: "\Device\"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP001.TMP\Qo8RZ34.exe" (Indicator: "\Device\"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp")57:Te62,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp")58:Tbe4,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004364.00000001.131521.00E71000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004364.00000001.131521.00E71000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004832.00000002.133494.00F81000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004832.00000002.133494.00F81000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00006816.00000000.129519.00BE1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00006816.00000000.129519.00BE1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")59:Tc56,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006816.00000000.129519.02D30000.00000004.mdmp, 00000000-00006816.00000002.133358.02D30000.00000004.mdmp")5a:T1319,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00000064.00000000.130102.02640000.00000004.mdmp, 00000000-00000064.00000002.133942.02640000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00002216.00000000.129710.005C0000.00000004.mdmp, 00000000-00002216.00000001.129778.005C0000.00000004.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00004364.00000001.131521.00820000.00000004.mdmp, 00000000-00004364.00000002.133442.00820000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00004832.00000000.129655.00920000.00000004.mdmp, 00000000-00004832.00000001.131575.00920000.00000004.mdmp, 00000000-00004832.00000002.133494.00920000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")5b:T7e0,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00002216.00000000.129710.00D01000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002216.00000000.129710.00D15000.00000002.mdmp, 00000000-00002216.00000000.129710.00D1D000.00000004.mdmp, 00000000-00002216.00000001.129778.00D1D000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004364.00000002.133442.00E7A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004832.00000001.131575.00F8A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006816.00000000.129519.00BEA000.00000002.mdmp")5c:Tafa,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 326c0d2bbb49dcde9f8821003c5de47d5d051ed1a9efd72994862409c7c666c9.bin] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: wK4CI45.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: wK4CI45.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: wK4CI45.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: wK4CI45.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: wK4CI45.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 6jI1OJ2.exe] Observed import api "IsValidAcl" which can "validate an access control list (ACL)" [Source: 6jI1OJ2.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: Qo8RZ34.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: Qo8RZ34.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Qo8RZ34.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: Qo8RZ34.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: Qo8RZ34.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 1qF29QN9.exe] Observed import api "IsValidAcl" which can "validate an access control list (ACL)" [Source: 1qF29QN9.exe]5d:T5b7," Microsoft Corporation\"\n \"Qo8RZ34.exe\" was detected as \"Microsoft visual C++ 8\"\n \"1qF29QN9.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"7bW8Ts60.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"2Sj9142.exe\" was detected as \"Safeguard v1.03 -> Simonzh\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69b7f71132dbd7e2ef0dc10c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"