Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "801da7d6cedd0ba03ad2ded6f85e726451ffad38d05a02b5aba0d26659641448.exe") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003720.00000000.110593.0026A000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003720.00000000.110593.02F30000.00000004.mdmp, 00000000-00003720.00000000.110593.03210000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003720.00000000.110593.02F30000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003720.00000000.110593.02F30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003720.00000000.110593.02F30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003720.00000000.110593.02F30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003720.00000000.110593.02F30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003720.00000000.110593.02F30000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00003720.00000000.110593.02F30000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005016.00000000.110538.02ED0000.00000004.mdmp, 00000000-00005016.00000001.112460.02ED0000.00000004.mdmp, 00000000-00005016.00000002.114380.02ED0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00005016.00000000.110538.02ED0000.00000004.mdmp, 00000000-00005016.00000001.112460.02ED0000.00000004.mdmp, 00000000-00005016.00000002.114380.00C50000.00000004.mdmp, 00000000-00005016.00000002.114380.02ED0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00005016.00000000.110538.02ED0000.00000004.mdmp, 00000000-00005016.00000001.112460.02ED0000.00000004.mdmp, 00000000-00005016.00000002.114380.02ED0000.00000004.mdmp") Found reference to API "L32.DLL" FUNCTION="CreateProcessW"/>" (Indicator: "CreateProcess"; Source: "00000000-00005016.00000000.110538.02ED0000.00000004.mdmp 00000000-00005016.00000001.112460.02ED0000.00000004.mdmp 00000000-00005016.00000002.114380.02ED0000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005016.00000000.110538.02ED0000.00000004.mdmp 00000000-00005016.00000001.112460.02ED0000.00000004.mdmp 00000000-00005016.00000002.114380.02ED0000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005016.00000000.110538.02ED0000.00000004.mdmp 00000000-00005016.00000001.112460.02ED0000.00000004.mdmp 00000000-00005016.00000002.114380.02ED0000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005016.00000000.110538.02ED0000.00000004.mdmp 00000000-00005016.00000001.112460.02ED0000.00000004.mdmp 00000000-00005016.00000002.114380.02ED0000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005016.00000000.110538.02ED0000.00000004.mdmp 00000000-00005016.00000001.112460.02ED0000.00000004.mdmp 00000000-00005016.00000002.114380.02ED0000.00000004.mdmp"), Found reference to API "PRINT NS_ElevateCreateProcess::APIHook_CreateProcessA 318 [ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00005016.00000000.110538.02ED0000.00000004.mdmp 00000000-00005016.00000001.112460.02ED0000.00000004.mdmp 00000000-00005016.00000002.114380.02ED0000.00000004.mdmp"), Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00005016.00000001.112460.00C8A000.00000002.mdmp"), Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00007576.00000000.111279.02F70000.00000004.mdmp 00000000-00007576.00000001.113199.00BF0000.00000004.mdmp 00000000-00007576.00000001.113199.02F80000.00000004.mdmp 00000000-00007576.00000002.115119.02F70000.00000004.mdmp 00000000-00007576.00000002.115119.02F80000.00000004.mdmp"), Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00007576.00000000.111279.02F70000.00000004.mdmp 00000000-00007576.00000002.115119.02F70000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00007576.00000001.113199.02F80000.00000004.mdmp 00000000-00007576.00000002.115119.02F80000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00007576.00000001.113199.02F80000.00000004.mdmp 00000000-00007576.00000002.115119.02F80000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00007576.00000001.113199.02F80000.00000004.mdmp 00000000-00007576.00000002.115119.02F80000.00000004.mdmp")