21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 83:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4d3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 9ffadd20c394… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9ffadd20c394…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 4/28 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable","compressed","sfx","7zip"],"identifier":"9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":4,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T98ce,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.45011000.00000002.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "VirtualAllocdBlocks" (Indicator: "VirtualAlloc"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLookaside" (Indicator: "FreeMemory"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004032.00000002.184711.45011000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004032.00000002.184711.45011000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006900.00000000.179905.72521000.00000004.mdmp, 00000000-00006900.00000002.183746.010A2000.00000004.mdmp")23:T761b,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlWow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlWow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlWow64SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwOpenThread" (Indicator: "OpenThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")24:T1f48,Found reference to API "RtlCompressBuffer" (Indicator: "RtlCompressBuffer"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlComputeCrc32" (Indicator: "RtlComputeCrc32"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlDecompressBuffer" (Indicator: "RtlDecompressBuffer"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlDecompressBufferEx" (Indicator: "RtlDecompressBuffer"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")25:T2773,Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "NtCreateThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")26:Tafe1,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp") Found reference to API "NtDelayExecution" (Indicator: "NtDelayExecution"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtSetTimer" (Indicator: "SetTimer"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtSetTimerResolution" (Indicator: "SetTimer"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlQueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlSetTimer" (Indicator: "SetTimer"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "TpSetTimer" (Indicator: "SetTimer"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "TpSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwSetTimer" (Indicator: "SetTimer"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")27:T465b,Found reference to API "NtImpersonateThread" (Indicator: "NtImpersonateThread"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")28:Td4e,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp") Found reference to API "After a callback to 0x%p(0x%p), an completion call to FreeLibrary(%p) failed with status 0x%08x." (Indicator: "FreeLibrary"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004032.00000002.184711.45011000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006900.00000000.179905.72521000.00000004.mdmp, 00000000-00006900.00000002.183746.010A2000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006900.00000000.179905.72521000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006900.00000000.179905.72521000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006900.00000000.179905.72521000.00000004.mdmp, 00000000-00006900.00000002.183746.010A2000.00000004.mdmp")29:T7c7,Found reference to API "ZwSetValueKey" (Indicator: "ZwSetValueKey"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")2a:T1781,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004032.00000001.182790.9DF20000.00000004.mdmp, 00000000-00004032.00000002.184711.9DF20000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004032.00000001.182790.9DF20000.00000004.mdmp, 00000000-00004032.00000002.184711.9DF20000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00004032.00000001.182790.9DF20000.00000004.mdmp, 00000000-00004032.00000002.184711.9DF20000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00004032.00000001.182790.9DF20000.00000004.mdmp, 00000000-00004032.00000002.184711.9DF20000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~!$&'()*+,;=:@/?" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00006900.00000001.181825.72404000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00006900.00000001.181825.72404000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00006900.00000001.181825.72404000.00000002.mdmp")2b:T1f56,Found reference to API "NtUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtUnmapViewOfSectionEx" (Indicator: "UnmapViewOfSection"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwUnmapViewOfSectionEx" (Indicator: "UnmapViewOfSection"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")2c:T7de,Found reference to "The cryptographic provider does not support HMAC." (Indicator: "HMAC"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")2d:T8fa,Found PE header "MZ" - Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000001.182790.A02E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000001.182790.A146C000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000001.182790.A1843000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000001.182790.A23E8000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000001.182790.A25DF000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000001.182790.A27C5000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000001.182790.A2D94000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000001.182790.A3173000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000001.182790.A3557000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000001.182790.A3B21000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000001.182790.A3D08000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000001.182790.A40E5000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000002.184711.A06CF000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000002.184711.A08C3000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000002.184711.A0E99000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000002.184711.A1083000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000002.184711.A1273000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000002.184711.A165D000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000002.184711.A1A34000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004032.00000002.184711.A2002000.00000004.mdmp")2e:Tb51,"" (Indicator: "enumchildwindows"; Source: "00000000-00006900.00000000.179905.00880000.00000004.mdmp, 00000000-00006900.00000001.181825.00880000.00000004.mdmp, 00000000-00006900.00000002.183746.00880000.00000004.mdmp")3a:T22d4,"" (Indicator: "GetDC"; Source: "00000000-00006900.00000000.179905.00880000.00000004.mdmp, 00000000-00006900.00000001.181825.00880000.00000004.mdmp, 00000000-00006900.00000002.183746.00880000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006900.00000000.179905.00880000.00000004.mdmp, 00000000-00006900.00000001.181825.00880000.00000004.mdmp, 00000000-00006900.00000002.183746.00880000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006900.00000000.179905.00880000.00000004.mdmp, 00000000-00006900.00000001.181825.00880000.00000004.mdmp, 00000000-00006900.00000002.183746.00880000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006900.00000000.179905.00880000.00000004.mdmp, 00000000-00006900.00000001.181825.00880000.00000004.mdmp, 00000000-00006900.00000002.183746.00880000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006900.00000000.179905.00880000.00000004.mdmp, 00000000-00006900.00000001.181825.00880000.00000004.mdmp, 00000000-00006900.00000002.183746.00880000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006900.00000000.179905.00880000.00000004.mdmp, 00000000-00006900.00000001.181825.00880000.00000004.mdmp, 00000000-00006900.00000002.183746.00880000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006900.00000000.179905.00880000.00000004.mdmp, 00000000-00006900.00000001.181825.00880000.00000004.mdmp, 00000000-00006900.00000002.183746.00880000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006900.00000000.179905.00880000.00000004.mdmp, 00000000-00006900.00000001.181825.00880000.00000004.mdmp, 00000000-00006900.00000002.183746.00880000.00000004.mdmp")65:T46f9,Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "RtlGetVersion"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "RtlGetVersion"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "RtlGetVersion"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "RtlGetVersion"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlGetNtProductType" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlGetNtVersionNumbers" (Indicator: "RtlGetNtVersionNumbers"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")66:T740e,Found registry query API: "RtlpQueryRegistryValues: Miscomputed buffer size at line %d" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry query API: "NtEnumerateKey" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry query API: "NtEnumerateValueKey" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry query API: "NtQueryKey" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry query API: "NtQueryValueKey" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry query API: "RtlCheckRegistryKey" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValues" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValuesEx" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry query API: "RtlpNtQueryValueKey" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry query API: "ZwEnumerateKey" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry query API: "ZwEnumerateValueKey" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry query API: "ZwQueryKey" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry query API: "ZwQueryValueKey" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry query API: "ZwSaveKey" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry query API: "ZwSaveKeyEx" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00006900.00000000.179905.72521000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00006900.00000000.179905.72521000.00000004.mdmp"67:T2f1e,Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtQuerySecurityObject" (Indicator: "NtQuerySecurityObject"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")68:T844,file/memory contains long string with (Indicator: "aes"; File: "network-impl.rc") Found string "The Diffie-Hellman group is not compatible with the policy type." (Indicator: "diffie-hellman"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")69:Tfa0,Found reference to API "NtCreateMailslotFile" (Indicator: "CreateMailslot"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwCreateMailslotFile" (Indicator: "CreateMailslot"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")6a:T461a,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp") Found reference to API "NtGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtGetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwGetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006900.00000000.179905.72521000.00000004.mdmp, 00000000-00006900.00000002.183746.010A2000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006900.00000000.179905.72521000.00000004.mdmp, 00000000-00006900.00000002.183746.010A2000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00006900.00000000.179905.72521000.00000004.mdmp, 00000000-00006900.00000002.183746.010A2000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006900.00000000.179905.72521000.00000004.mdmp, 00000000-00006900.00000002.183746.010A2000.00000004.mdmp")6b:T110b,Found reference to API "ReadFile" (Indicator: "ReadFile"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "ReadFile" (Indicator: "ReadFile"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp") Found reference to API "NtReadFile" (Indicator: "NtReadFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwReadFile" (Indicator: "ZwReadFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ReadFile" (Indicator: "ReadFile"; Source: "00000000-00006900.00000000.179905.72521000.00000004.mdmp")6c:T2190,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp, 00000000-00004032.00000002.184711.45011000.00000002.mdmp") Found reference to API "SE_GetProcAddressForCaller" (Indicator: "GetProcAddress"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "LdrGetProcedureAddress" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "LdrGetProcedureAddressEx" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "LdrGetProcedureAddressForCaller" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006900.00000000.179905.72521000.00000004.mdmp, 00000000-00006900.00000002.183746.010A2000.00000004.mdmp")6d:T3dc0,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp") Found reference to API "NtQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlGetCurrentDirectory_U" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006900.00000000.179905.72521000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00006900.00000000.179905.72521000.00000004.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00006900.00000000.179905.72521000.00000004.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00006900.00000000.179905.72521000.00000004.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006900.00000000.179905.72521000.00000004.mdmp")6e:T7c8,Found reference to API "CsrGetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")6f:T888,Found reference to API "NtGetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00006900.00000000.179905.72521000.00000004.mdmp, 00000000-00006900.00000002.183746.010A2000.00000004.mdmp")70:T1791,Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlCheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwQueryInformationToken" (Indicator: "ZwQueryInformationToken"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")71:Tca63,Found string "The Windows password is too complex to be converted to a LAN Manager password. The LAN Manager password returned is a NULL string." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "When trying to update a password, this return status indicates that the value provided as the current password is not correct." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "When trying to update a password, this return status indicates that the value provided for the new password contains values that are not allowed in passwords." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "When trying to update a password, this status indicates that some password update rule has been violated. For example, the password may not meet length criteria." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "The user account's password has expired." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "You specified an incorrect password to a LAN Manager 2.x or MS-NET server." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "The maximum number of secrets that may be stored in a single system has been exceeded. The length and number of secrets is limited to satisfy United States State Department export restrictions." (Indicator: "secret"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "The length of a secret exceeds the maximum length allowed. The length and number of secrets is limited to satisfy United States State Department export restrictions." (Indicator: "secret"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "An attempt was made to change a user password in the security account manager without providing the necessary Windows cross-encrypted password." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "An attempt was made to change a user password in the security account manager without providing the necessary LM cross-encrypted password." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "The workstation does not have a trust secret for the primary domain in the local LSA database." (Indicator: "secret"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "The user's password must be changed before signing in." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "The password provided is too short to meet the policy of your user account. Please choose a longer password." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "You have attempted to change your password to one that you have used in the past. The policy of your user account does not allow this. Please select a password that you have not previously used." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "The password provided is too long to meet the policy of your user account. Please choose a shorter password." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "Mutual Authentication failed. The server's password is out of date at the domain controller." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "Security Account Manager needs to get the boot password." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "EAS policy requires that the user change their password before this operation can be performed." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "The local account store does not contain secret material for the specified account." (Indicator: "secret"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "The BitLocker startup key or recovery password could not be read from external media." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "The BitLocker startup key or recovery password file is corrupt or invalid." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "The BitLocker encryption key could not be obtained from the startup key or recovery password." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found string "Device Lock has been triggered due to too many incorrect password attempts." (Indicator: "password"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")72:T2665,Found registry deletion API: "NtDeleteKey" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry deletion API: "NtDeleteValueKey" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry deletion API: "RtlDeleteRegistryValue" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry deletion API: "ZwDeleteKey" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp" Found registry deletion API: "ZwDeleteValueKey" in "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp"73:T10ae,Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "NtDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")74:T1776,Found reference to API "The range specified in NtUnlockFile was not locked." (Indicator: "NtUnlockFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtLockFile" (Indicator: "NtLockFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtUnlockFile" (Indicator: "NtUnlockFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")75:T1791,Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlCheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwQueryInformationToken" (Indicator: "ZwQueryInformationToken"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")76:T1ff2,Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")77:T122c5,Found reference to API "NtAccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtAccessCheckAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheck"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheckByType"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeAndAuditAlarm" (Indicator: "AccessCheckByType"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheck"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheckByType"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheckByType"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheck"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheckByType"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtAllocateLocallyUniqueId" (Indicator: "AllocateLocallyUniqueId"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtDuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtImpersonateAnonymousToken" (Indicator: "ImpersonateAnonymousToken"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "NtPrivilegeCheck" (Indicator: "PrivilegeCheck"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAceEx"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedObjectAce" (Indicator: "AddAccessAllowedObjectAce"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAce" (Indicator: "AddAccessDeniedAce"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAceEx" (Indicator: "AddAccessDeniedAce"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAceEx" (Indicator: "AddAccessDeniedAceEx"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedObjectAce" (Indicator: "AddAccessDeniedObjectAce"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAddAce" (Indicator: "AddAce"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAddAuditAccessAce" (Indicator: "AddAuditAccessAce"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAddAuditAccessAceEx" (Indicator: "AddAuditAccessAce"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAddAuditAccessAceEx" (Indicator: "AddAuditAccessAceEx"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAddAuditAccessObjectAce" (Indicator: "AddAuditAccessObjectAce"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAddMandatoryAce" (Indicator: "AddMandatoryAce"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAddResourceAttributeAce" (Indicator: "AddResourceAttributeAce"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAddScopedPolicyIDAce" (Indicator: "AddScopedPolicyIDAce"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")78:T19d8,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp, 00000000-00004032.00000002.184711.45011000.00000002.mdmp") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "ZwTerminateProcess"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")79:T1094,Found reference to API "WriteFile" (Indicator: "WriteFile"; File: "9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00004032.00000001.182790.9B288000.00000002.mdmp") Found reference to API "NtWriteFile" (Indicator: "NtWriteFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp") Found reference to API "ZwWriteFile" (Indicator: "ZwWriteFile"; Source: "00000000-00004032.00000001.182790.9F9CE000.00000004.mdmp, 00000000-00004032.00000001.182790.A02E0000.00000004.mdmp, 00000000-00004032.00000001.182790.A146C000.00000004.mdmp, 00000000-00004032.00000001.182790.A1843000.00000004.mdmp, 00000000-00004032.00000001.182790.A1E1B000.00000004.mdmp, 00000000-00004032.00000001.182790.A23E8000.00000004.mdmp, 00000000-00004032.00000001.182790.A25DF000.00000004.mdmp, 00000000-00004032.00000001.182790.A27C5000.00000004.mdmp, 00000000-00004032.00000001.182790.A2D94000.00000004.mdmp, 00000000-00004032.00000001.182790.A3173000.00000004.mdmp, 00000000-00004032.00000001.182790.A3557000.00000004.mdmp, 00000000-00004032.00000001.182790.A3B21000.00000004.mdmp, 00000000-00004032.00000001.182790.A3D08000.00000004.mdmp, 00000000-00004032.00000001.182790.A40E5000.00000004.mdmp, 00000000-00004032.00000002.184711.A06CF000.00000004.mdmp, 00000000-00004032.00000002.184711.A08C3000.00000004.mdmp, 00000000-00004032.00000002.184711.A0ABB000.00000004.mdmp, 00000000-00004032.00000002.184711.A0CAE000.00000004.mdmp, 00000000-00004032.00000002.184711.A0E99000.00000004.mdmp, 00000000-00004032.00000002.184711.A1083000.00000004.mdmp, 00000000-00004032.00000002.184711.A1273000.00000004.mdmp, 00000000-00004032.00000002.184711.A165D000.00000004.mdmp, 00000000-00004032.00000002.184711.A1A34000.00000004.mdmp, 00000000-00004032.00000002.184711.A1C2D000.00000004.mdmp, 00000000-00004032.00000002.184711.A2002000.00000004.mdmp, 00000000-00004032.00000002.184711.A21F6000.00000004.mdmp, 00000000-00004032.00000002.184711.A29BC000.00000004.mdmp, 00000000-00004032.00000002.184711.A2BAB000.00000004.mdmp, 00000000-00004032.00000002.184711.A2F87000.00000004.mdmp, 00000000-00004032.00000002.184711.A336C000.00000004.mdmp, 00000000-00004032.00000002.184711.A374D000.00000004.mdmp, 00000000-00004032.00000002.184711.A3939000.00000004.mdmp, 00000000-00004032.00000002.184711.A3EF6000.00000004.mdmp")7a:Tb9d,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006900.00000000.179905.00880000.00000004.mdmp, 00000000-00006900.00000001.181825.00880000.00000004.mdmp, 00000000-00006900.00000002.183746.00880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69e260b9bd1a0f5a290029b8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69e260b9bd1a0f5a290029b8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"9ffadd20c3946d7a635f48a91ab2ca00e6374ff05bf3ac9344e5d2758d3302ba.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69e260b9bd1a0f5a290029b8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"69e260b9bd1a0f5a290029b8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69e260b9bd1a0f5a290029b8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$2d","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69e260b9bd1a0f5a290029b8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69e260b9bd1a0f5a290029b8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"PCAP contains base64 strings","description":"Contains base64 encoded string \"rdoO18eeTiO3/BND5iZ7rQ==\" in [Source : PCAP]","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-504","sources":[{"report_type":"sandbox","report_id":"69e260b9bd1a0f5a290029b8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"