24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 77:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T498,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Generik.NUWGISW trojan Sample a5c2cd0db95e… — Score 75/100 — Hybrid Analysis","description":"Malicious verdict for sample a5c2cd0db95e…. Malware family: Generik.NUWGISW trojan. Threat score 75/100. 1/25 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a5c2cd0db95e87a627f59f7c0b66753969a6a036744e21e437ead5074b9a30a3","keywords":["Malicious","Generik.NUWGISW trojan","malware analysis","sandbox report","threat intelligence","a5c2cd0db95e87a627f59f7c0b66753969a6a036744e21e437ead5074b9a30a3"],"about":{"@type":"SoftwareApplication","name":"GMWGRSCK.msi","applicationCategory":["msi","data"],"identifier":"a5c2cd0db95e87a627f59f7c0b66753969a6a036744e21e437ead5074b9a30a3","additionalType":"Malicious sample"},"threatScore":75,"malwareFamily":"Generik.NUWGISW trojan","antivirusDetections":{"malicious":1,"total":25},"behavioralIndicators":{"malicious":1,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1e60,Found reference to API "RtlCompressBuffer" (Indicator: "RtlCompressBuffer"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlComputeCrc32" (Indicator: "RtlComputeCrc32"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlDecompressBuffer" (Indicator: "RtlDecompressBuffer"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlDecompressBufferEx" (Indicator: "RtlDecompressBuffer"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp")26:T28c1,Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "NtCreateThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "NtCreateThread"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp")27:Td4c7,Found reference to API "NtDelayExecution" (Indicator: "NtDelayExecution"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtSetTimer" (Indicator: "SetTimer"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtSetTimerResolution" (Indicator: "SetTimer"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlQueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlSetTimer" (Indicator: "SetTimer"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "TpSetTimer" (Indicator: "SetTimer"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "TpSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwSetTimer" (Indicator: "SetTimer"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwSetTimerResolution" (Indicator: "SetTimer"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwWaitForMultipleObjects32" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp")28:T456d,Found reference to API "NtImpersonateThread" (Indicator: "NtImpersonateThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")29:T8757,Found reference to API "tCreateThread" (Indicator: "CreateThread"; Source: "00000000-00005772.00000000.129308.35AD0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005772.00000000.129308.4A5F0000.00000002.mdmp, 00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005772.00000000.129308.4A5F0000.00000002.mdmp, 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp, 00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005772.00000000.129308.4A5F0000.00000002.mdmp, 00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "VirtualAllocdBlocks" (Indicator: "VirtualAlloc"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLookaside" (Indicator: "FreeMemory"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")2a:Te73,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005772.00000000.129308.4A5F0000.00000002.mdmp, 00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "After a callback to 0x%p(0x%p), an completion call to FreeLibrary(%p) failed with status 0x%08x." (Indicator: "FreeLibrary"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007380.00000000.128462.720D9000.00000002.mdmp, 00000000-00007380.00000001.130383.721E1000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007380.00000000.128462.720D9000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007380.00000000.128462.721D1000.00000020.mdmp") Found reference to API "After a callback to 0x%p(0x%p), an completion call to FreeLibrary(%p) failed with status 0x%08x." (Indicator: "FreeLibrary"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp")2b:T815,Found reference to API "ZwSetValueKey" (Indicator: "ZwSetValueKey"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")2c:T144f,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005772.00000001.131036.37750000.00000004.mdmp, 00000000-00005772.00000002.132955.37750000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005772.00000001.131036.37750000.00000004.mdmp, 00000000-00005772.00000002.132955.37750000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00005772.00000001.131036.37750000.00000004.mdmp, 00000000-00005772.00000002.132955.37750000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00005772.00000001.131036.37750000.00000004.mdmp, 00000000-00005772.00000002.132955.37750000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp")2d:T1e6e,Found reference to API "NtUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtUnmapViewOfSectionEx" (Indicator: "UnmapViewOfSection"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwUnmapViewOfSectionEx" (Indicator: "UnmapViewOfSection"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp")2e:T8b8,Found reference to "The cryptographic provider does not support HMAC." (Indicator: "HMAC"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to "The cryptographic provider does not support HMAC." (Indicator: "HMAC"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp")2f:T8fa,Found PE header "MZ" - Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.131036.38EFF000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.131036.398AA000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.131036.39E7D000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.131036.3A06E000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.131036.3A44E000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.131036.3A635000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.131036.3AC06000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.131036.3B99E000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.131036.3BB84000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000001.131036.3BD71000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.132955.378C1000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.132955.381F0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.132955.3854A000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.132955.38732000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.132955.38929000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.132955.38B18000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.132955.390E7000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.132955.392DA000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.132955.394CF000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.132955.396BD000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.132955.39A97000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005772.00000002.132955.39C84000.00000004.mdmp")30:Tfb8,Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005772-00000C2A-1033810600") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp")31:Tf48,Found reference to API "NtQueryDefaultUILanguage" (Indicator: "ntquerydefaultuilanguage"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQueryInstallUILanguage" (Indicator: "ntqueryinstalluilanguage"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp")32:T10e4,Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00005772-00000C2A-1033886850") Found reference to API "WMRSendMessageString" (Indicator: "sendmessage"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp") Found reference to API "?PostMessageW@CWindowWnd@DuiLib@@QAEJIIJ@Z" (Indicator: "postmessage"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "?SendMessageW@CWindowWnd@DuiLib@@QAEJIIJ@Z" (Indicator: "sendmessage"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "?TxSendMessage@CRichEditUI@DuiLib@@UBEJIIJPAJ@Z" (Indicator: "sendmessage"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "WMRSendMessageString" (Indicator: "sendmessage"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp")33:T9e5,"ParallelDr32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005772) "ParallelDr32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005772) "ParallelDr32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac37acfe7f0000000000000000000051edddadfe7f000000000000fe7f0000000000000000000073865d8c43770000000001001a00010040ddeeadfe7f00008fecddadfe7f0000e0ac37acfe7f0000e0ac37acfe7f0000000000000000000000000000fe7f0000ffffff7f52b0000000000000000000000000000000000000d8ce2bacfe7f00002a0000000000000069c3e4abfe7f00003100000000000000a801000000000000ac010000000000001100011000000000b0e4df3d5600000003a36eabfe7f0000b0e4df3d5600000000000000000000002b00000000000000000000000000000020b0eaabfe7f0000b43fe9abfe7f0000e0ce2bac (UID: 00000000-00005772) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008284)34:Ta79,Found reference to API "RtlGetSystemTimePrecise" (Indicator: "GetSystemTime"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00007380.00000000.128462.01003000.00000002.mdmp, 00000000-00007380.00000000.128462.720D9000.00000002.mdmp, 00000000-00007380.00000000.128462.72165000.00000002.mdmp, 00000000-00007380.00000001.130383.721E1000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp")35:T448,Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007380.00000000.128462.01003000.00000002.mdmp, 00000000-00007380.00000000.128462.720D9000.00000002.mdmp, 00000000-00007380.00000000.128462.72165000.00000002.mdmp, 00000000-00007380.00000001.130383.721E1000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp")36:T586e,Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005772.00000000.129308.4A5F0000.00000002.mdmp, 00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "QuerySystemInformation"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlExpandEnvironmentStrings" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlExpandEnvironmentStrings_U" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlGetNativeSystemInformation" (Indicator: "RtlGetNativeSystemInformation"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlGetNativeSystemInformation" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlNtStatusToDosErrorNoTeb" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwQuerySystemInformation" (Indicator: "QuerySystemInformation"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwQuerySystemInformationEx" (Indicator: "QuerySystemInformation"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00007380.00000000.128462.720D9000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00007380.00000000.128462.720D9000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp")37:Ta79,Found reference to API "RtlGetSystemTimePrecise" (Indicator: "GetSystemTime"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00007380.00000000.128462.01003000.00000002.mdmp, 00000000-00007380.00000000.128462.720D9000.00000002.mdmp, 00000000-00007380.00000000.128462.72165000.00000002.mdmp, 00000000-00007380.00000001.130383.721E1000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp")38:T570,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp")39:T837,Found reference to API "TermsrvGetWindowsDirectoryW" (Indicator: "GetWindowsDirectory"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "GetWindowsDirectoryW" (Indicator: "GetWindowsDirectory"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")3a:T1080,Found reference to API "RtlGetUserPreferredUILanguages" (Indicator: "GetUserPreferredUILanguages"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlpGetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp")3b:T600d,Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "GetVersion"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "GetVersion"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "GetVersion"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "GetVersion"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "VerifyVersionInfo"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "VerifyVersionInfoSwitch" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp, 00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "GetVersion"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "GetVersion"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "GetVersion"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "GetVersion"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "VerifyVersionInfo"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp") Found reference to API "VerifyVersionInfoSwitch" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp")3c:Tff0,Found reference to API "NtQueryVolumeInformationFile" (Indicator: "NtQueryVolumeInformationFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwQueryVolumeInformationFile" (Indicator: "ZwQueryVolumeInformationFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "GetVolumeInformationW" (Indicator: "GetVolumeInformation"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")3d:Tf20,Found reference to API "NtSetLdtEntries" (Indicator: "SetLdtEntries"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwSetLdtEntries" (Indicator: "SetLdtEntries"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp")3e:T922,Observed string: "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" (Indicator: "hardware\description\system\centralprocessor") in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp Observed string: "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" (Indicator: "hardware\description\system\centralprocessor") in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp3f:T6ee,"ParallelDr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005772) "ParallelDr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005772) "ParallelDr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005772) "ParallelDr32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005772) "ParallelDr32.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00005772) "ParallelDr32.exe" called "LoadLibrary" with a parameter rpcrt4.dll (UID: 00000000-00005772) "ParallelDr32.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005772) "ParallelDr32.exe" called "LoadLibrary" with a parameter gdi32 (UID: 00000000-00005772) "ParallelDr32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005772) "ParallelDr32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005772) "ParallelDr32.exe" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00005772) "ParallelDr32.exe" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00005772) "ParallelDr32.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005772) "ParallelDr32.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00005772) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008284) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008284) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008284) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008284)40:T6b13,"ParallelDr32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter NtQuerySystemTime (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter NtClose (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter NtCreateFile (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter NtOpenFile (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter NtReadFile (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter RtlInitUnicodeString (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter NtCreateEvent (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter RtlEnterCriticalSection (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter RtlLeaveCriticalSection (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter LdrEnumerateLoadedModules (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter QueryDosDeviceW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter VirtualQueryEx (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter OpenFile (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter OpenFileMappingA (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CreateRemoteThread (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatus (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetOverlappedResult (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter MoveFileW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetWindowDC (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter PrintWindow (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter SetClipboardData (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter OpenClipboard (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CloseClipboard (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter EmptyClipboard (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WindowFromPoint (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter ToUnicodeEx (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetKeyboardState (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter MenuItemFromPoint (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter RealGetWindowClassW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetMenuItemID (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter MapVirtualKeyW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter SetWindowsHookExW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CallNextHookEx (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter UnhookWindowsHookEx (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter UnhookWinEvent (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter IsClipboardFormatAvailable (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetClipboardData (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter PrivilegeCheck (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter DuplicateToken (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter GetHGlobalFromStream (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CoGetObject (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter CryptProtectData (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WinHttpAddRequestHeaders (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WinHttpQueryOption (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter isalnum (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter isdigit (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter isspace (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter isxdigit (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter tolower (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter inet_ntop (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter getsockname (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00005772) "ParallelDr32.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00005772) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008284) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008284)41:T4068,Found reference to API "NtCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtCreateProcessEx" (Indicator: "CreateProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlCreateProcessParameters" (Indicator: "CreateProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlCreateProcessParametersEx" (Indicator: "CreateProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlCreateProcessReflection" (Indicator: "CreateProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlpCreateProcessRegistryInfo" (Indicator: "CreateProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwCreateProcessEx" (Indicator: "CreateProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "odCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp") Found reference to API "odCreateProcess64" (Indicator: "CreateProcess"; Source: "00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp")42:T1fc4,Found reference to API "NtCreateDirectoryObject" (Indicator: "CreateDirectory"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtCreateDirectoryObjectEx" (Indicator: "CreateDirectory"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwCreateDirectoryObject" (Indicator: "CreateDirectory"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwCreateDirectoryObjectEx" (Indicator: "CreateDirectory"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00007380.00000000.128462.720D9000.00000002.mdmp, 00000000-00007380.00000000.128462.72165000.00000002.mdmp")43:T267e,Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtFsControlFile" (Indicator: "FsControlFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwFsControlFile" (Indicator: "FsControlFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")44:T17ce,Found reference to API "ZwCreateKey" (Indicator: "ZwCreateKey"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwCreateKeyTransacted" (Indicator: "ZwCreateKey"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwCreateKeyedEvent" (Indicator: "ZwCreateKey"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RegConnectRegistryW" (Indicator: "RegConnectRegistry"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")45:T4361,Found reference to API "The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines." (Indicator: "CreateFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines." (Indicator: "NtCreateFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwCreateFile" (Indicator: "CreateFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwCreateFile" (Indicator: "ZwCreateFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwOpenFile" (Indicator: "ZwOpenFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "IcmpCreateFile" (Indicator: "CreateFile"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00007380.00000000.128462.720D9000.00000002.mdmp, 00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines." (Indicator: "CreateFile"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp") Found reference to API "The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines." (Indicator: "NtCreateFile"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp")46:T62e8,Found reference to API "FindResource API entry" (Indicator: "FindResource"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "FindResourceEx API entry" (Indicator: "FindResource"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "LoadResource API entry" (Indicator: "LoadResource"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "FindResource API exit" (Indicator: "FindResource"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "FindResourceEx API exit" (Indicator: "FindResource"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "LoadResource API exit" (Indicator: "LoadResource"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "LdrpLoadResourceFromAlternativeModule" (Indicator: "LoadResource"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "LdrFindResourceDirectory_U" (Indicator: "FindResource"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "LdrFindResourceEx_U" (Indicator: "FindResource"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "LdrFindResource_U" (Indicator: "FindResource"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "LdrResFindResource" (Indicator: "FindResource"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "LdrResFindResourceDirectory" (Indicator: "FindResource"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "?LoadResource@CResourceManager@DuiLib@@QAEHVCMarkupNode@2@@Z" (Indicator: "LoadResource"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "?LoadResource@CResourceManager@DuiLib@@QAEHVSTRINGorID@2@PB_W@Z" (Indicator: "LoadResource"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "FindResource API entry" (Indicator: "FindResource"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp")47:T1e32,Found reference to API "NtOpenEvent" (Indicator: "NtOpenEvent"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtOpenEventPair" (Indicator: "NtOpenEvent"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwOpenEvent" (Indicator: "ZwOpenEvent"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwOpenEventPair" (Indicator: "ZwOpenEvent"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp")48:Tf18,Found reference to API "ZwQueryEaFile" (Indicator: "ZwQueryEaFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwSetEaFile" (Indicator: "ZwSetEaFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp")49:Ta1c9,Found reference to API "tCreateThread" (Indicator: "CreateThread"; Source: "00000000-00005772.00000000.129308.35AD0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005772.00000000.129308.4A5F0000.00000002.mdmp, 00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlWow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlWow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlWow64SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwOpenThread" (Indicator: "OpenThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")4a:T3817,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00005772.00000000.129308.4A5F0000.00000002.mdmp, 00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005772.00000000.129308.4A5F0000.00000002.mdmp, 00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlGetProcessHeaps" (Indicator: "GetProcessHeap"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00007380.00000000.128462.01003000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp")4b:T5f8,Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005772.00000000.129308.4A5F0000.00000002.mdmp, 00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007380.00000000.128462.01003000.00000002.mdmp, 00000000-00007380.00000000.128462.720D9000.00000002.mdmp, 00000000-00007380.00000000.128462.72165000.00000002.mdmp, 00000000-00007380.00000001.130383.721E1000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00007380.00000000.128462.720D9000.00000002.mdmp, 00000000-00007380.00000001.130383.721E1000.00000002.mdmp") Found reference to API "?GetLastErrorLocation@CDialogBuilder@DuiLib@@QBEXPA_WK@Z" (Indicator: "GetLastError"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "?GetLastErrorLocation@CMarkup@DuiLib@@QBEXPA_WK@Z" (Indicator: "GetLastError"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "?GetLastErrorMessage@CDialogBuilder@DuiLib@@QBEXPA_WK@Z" (Indicator: "GetLastError"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "?GetLastErrorMessage@CMarkup@DuiLib@@QBEXPA_WK@Z" (Indicator: "GetLastError"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp")4c:T17a96,"SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00005772.00000001.131036.37750000.00000004.mdmp 00000000-00005772.00000002.132955.37750000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005772.00000001.131036.37750000.00000004.mdmp 00000000-00005772.00000002.132955.37750000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp 00000000-00005772.00000001.131036.398AA000.00000004.mdmp 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp 00000000-00005772.00000001.131036.3A635000.00000004.mdmp 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp 00000000-00005772.00000002.132955.378C1000.00000004.mdmp 00000000-00005772.00000002.132955.381F0000.00000004.mdmp 00000000-00005772.00000002.132955.3854A000.00000004.mdmp 00000000-00005772.00000002.132955.38732000.00000004.mdmp 00000000-00005772.00000002.132955.38929000.00000004.mdmp 00000000-00005772.00000002.132955.38B18000.00000004.mdmp 00000000-00005772.00000002.132955.390E7000.00000004.mdmp 00000000-00005772.00000002.132955.392DA000.00000004.mdmp 00000000-00005772.00000002.132955.394CF000.00000004.mdmp 00000000-00005772.00000002.132955.396BD000.00000004.mdmp 00000000-00005772.00000002.132955.39A97000.00000004.mdmp 00000000-00005772.00000002.132955.39C84000.00000004.mdmp 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp 00000000-00005772.00000002.132955.3A828000.00000004.mdmp 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00005772.00000002.132955.C73FA000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005772.00000002.132955.C73FA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00005772.00000002.132955.C73FA000.00000002.mdmp "Software\Microsoft\CTF\LayoutIcon" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "Software\Microsoft\CTF\InputDll" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "Software\Microsoft\CTF\DirectSwitchHotkeys" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "Software\Microsoft\CTF\SortOrder\AssemblyItem" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "Software\Microsoft\CTF\SortOrder\Language" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "Software\Microsoft\CTF\HiddenDummyLayouts" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "Software\Microsoft\CTF\Assemblies" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "Software\Microsoft\CTF\TIP" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "Software\Microsoft\CTF" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Keyboard Layouts\%08x" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "SOFTWARE\Classes\CLSID\%s\InprocServer32" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "SOFTWARE\Classes\CLSID\%s\LocalServer32" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "Software\Microsoft\CTF\TIP\%s\LanguageProfile\0x0000%04x\%s" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "Software\Microsoft\Internet Explorer\International" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "S-1-5-20\Software\Microsoft\CTF" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "S-1-5-19\Software\Microsoft\CTF" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp ".DEFAULT\Software\Microsoft\CTF" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "SOFTWARE\Microsoft\CTF\TIP\" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Keyboard Layouts" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\MSCTF" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "System\CurrentControlSet\Control\Keyboard Layouts" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "System\ControlSet001\Control\Keyboard Layouts" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\Locale" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "System\ControlSet001\Control\Nls\Locale" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007380.00000000.128462.036E0000.00000004.mdmp 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007380.00000001.130383.036E0000.00000004.mdmp 00000000-00007380.00000002.132302.036E0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SecurityManager\AdminCapabilities" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "System\CurrentControlSet\Control\CMF\Config" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp ")\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Session Manager\kernel" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\windows nt\CurrentVersion\Image File Execution Options\" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\%ws" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ValidationRunlevels" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp "System\CurrentControlSet\Control\CMF\LatestIndex" in Source: 00000000-00007380.00000001.130383.06A21000.00000004.mdmp 00000000-00007380.00000002.132302.06D40000.00000004.mdmp 00000000-00007380.00000002.132302.071BE000.00000004.mdmp4d:T990,"ParallelDr32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffeaa270000 "ParallelDr32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffeaa270000 "ParallelDr32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffeaa270000 "ParallelDr32.exe" loaded module "KERNEL32" at base 7ffeabce0000 "ParallelDr32.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe94870000 "ParallelDr32.exe" loaded module "MSVCRT.DLL" at base 7ffeab6c0000 "ParallelDr32.exe" loaded module "RPCRT4.DLL" at base 7ffeadb20000 "ParallelDr32.exe" loaded module "USER32.DLL" at base 7ffeab370000 "ParallelDr32.exe" loaded module "GDI32" at base 7ffeadaf0000 "ParallelDr32.exe" loaded module "NTDLL.DLL" at base 7ffeadd90000 "ParallelDr32.exe" loaded module "KERNEL32.DLL" at base 7ffeabce0000 "ParallelDr32.exe" loaded module "PSAPI.DLL" at base 7ffeabcc0000 "ParallelDr32.exe" loaded module "ADVAPI32.DLL" at base 7ffeabc10000 "ParallelDr32.exe" loaded module "GDIPLUS.DLL" at base 7ffe8a090000 "ParallelDr32.exe" loaded module "CRYPT32.DLL" at base 7ffeaa940000 "ParallelDr32.exe" loaded module "WINHTTP.DLL" at base 7ffea66a0000 "ParallelDr32.exe" loaded module "SHELL32.DLL" at base 7ffeabd90000 "ParallelDr32.exe" loaded module "WS2_32.DLL" at base 7ffeab300000 "ParallelDr32.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffea9970000 "ParallelDr32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffea8820000 "ParallelDr32.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base 7ffe8a090000 "ParallelDr32.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffea1e70000 "cmd.exe" loaded module "KERNEL32" at base 75080000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75670000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75670000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75670000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74510000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75670000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75670000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75670000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 725f0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 750800004e:T589,Process "msiexec.exe" (UID: 00000000-00001608) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, PSModulePath, APPDATA, USERNAME, CommonProgramFiles, Path, PATHEXT, TEMP, USERPROFILE, TMP, ProgramFiles" Process "msiexec.exe" (UID: 00000000-00001608) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, PROMPT, OneDrive, PROCESSOR_ARCHITEW6432, HOMEPATH, HOMEDRIVE" Process "Bandwidth_Cluste.exe" (UID: 00000000-00006812) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", OneDrive="%USERPROFILE%\OneDrive", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:"" Process "Bandwidth_Cluste.exe" (UID: 00000000-00006812) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "Bandwidth_Cluste.exe" (UID: 00000000-00007380) was launched with new environment variables: "NFSRUVMNVDFTOGPZQOCNXCATH="gjavrm", PROCESSOR_ARCHITEW6432="AMD64"" Process "Bandwidth_Cluste.exe" (UID: 00000000-00007380) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "ParallelDr32.exe" (UID: 00000000-00005772) was launched with new environment variables: "JPOHOMJYSQGBTTZLEBEH="%TEMP%\1938EE0.tmp", GRPXRUZPPAOMFHTUACUYLJLIQ="%TEMP%\1A9B4AA.tmp""4f:T25e4,Found reference to API "LdrLoadDll" (Indicator: "LdrLoadDll"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "LdrGetDllHandleEx" (Indicator: "LdrGetDllHandle"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "LdrGetDllHandle" (Indicator: "LdrGetDllHandle"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "LdrGetDllHandleByMapping" (Indicator: "LdrGetDllHandle"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "LdrGetDllHandleByName" (Indicator: "LdrGetDllHandle"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp")50:T793,Found reference to API "RtlCreateServiceSid" (Indicator: "CreateService"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp")51:Tf38,Found reference to API "NtRollbackTransaction" (Indicator: "RollbackTransaction"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwRollbackTransaction" (Indicator: "RollbackTransaction"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp")52:T1e4e,Found reference to API "NtQueueApcThread" (Indicator: "QueueApcThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQueueApcThreadEx" (Indicator: "QueueApcThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwQueueApcThread" (Indicator: "QueueApcThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwQueueApcThreadEx" (Indicator: "QueueApcThread"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp")53:T578,"ParallelDr32.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 6 sections"- Location: [%LOCALAPPDATA%\ParallelDr32.exe]- [targetUID: 00000000-00007380] "DuiLib_u.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%ALLUSERSPROFILE%\Managefirefox_vjg_beta\DuiLib_u.dll]- [targetUID: 00000000-00007380] "Bandwidth_Cluste.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%ALLUSERSPROFILE%\Managefirefox_vjg_beta\Bandwidth_Cluste.exe]- [targetUID: 00000000-00007380] "msvcp140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections"- Location: [%ALLUSERSPROFILE%\Managefirefox_vjg_beta\msvcp140.dll]- [targetUID: 00000000-00007380] "vcruntime140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [%ALLUSERSPROFILE%\Managefirefox_vjg_beta\vcruntime140.dll]- [targetUID: 00000000-00007380] "1938EE0.tmp" has type "data"- Location: [%TEMP%\1938EE0.tmp]- [targetUID: 00000000-00007380] "Poddraeg.od" has type "data"- Location: [%ALLUSERSPROFILE%\Managefirefox_vjg_beta\Poddraeg.od]- [targetUID: 00000000-00007380] "Chob.xoyu" has type "data"- Location: [%ALLUSERSPROFILE%\Managefirefox_vjg_beta\Chob.xoyu]- [targetUID: 00000000-00007380] "1A9B4AA.tmp" has type "data"- Location: [%TEMP%\1A9B4AA.tmp]- [targetUID: 00000000-00007380]54:T5c3,"Bandwidth_Cluste.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Bandwidth_Cluste.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Bandwidth_Cluste.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Bandwidth_Cluste.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Bandwidth_Cluste.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Bandwidth_Cluste.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Bandwidth_Cluste.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Bandwidth_Cluste.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "Bandwidth_Cluste.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "Bandwidth_Cluste.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "Bandwidth_Cluste.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")55:Taa7,"Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "BANDWIDTH_CLUSTE.EXE"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")56:T7e2,"Bandwidth_Cluste.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Bandwidth_Cluste.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Caracal\VSSAPI.DLL" "Bandwidth_Cluste.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Caracal\VSSTRACE.DLL" "Bandwidth_Cluste.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Caracal\INPUT.DLL" "Bandwidth_Cluste.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Caracal\USERENV.DLL" "Bandwidth_Cluste.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Caracal\D3D9.DLL" "Bandwidth_Cluste.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Caracal\DWMAPI.DLL" "Bandwidth_Cluste.exe" trying to access non-existent file "C:\ProgramData\Managefirefox_vjg_beta\VSSAPI.DLL" "Bandwidth_Cluste.exe" trying to access non-existent file "C:\ProgramData\Managefirefox_vjg_beta\VSSTRACE.DLL" "Bandwidth_Cluste.exe" trying to access non-existent file "C:\ProgramData\Managefirefox_vjg_beta\INPUT.DLL" "Bandwidth_Cluste.exe" trying to access non-existent file "C:\ProgramData\Managefirefox_vjg_beta\USERENV.DLL" "Bandwidth_Cluste.exe" trying to access non-existent file "C:\ProgramData\Managefirefox_vjg_beta\D3D9.DLL" "Bandwidth_Cluste.exe" trying to access non-existent file "C:\ProgramData\Managefirefox_vjg_beta\DWMAPI.DLL" "Bandwidth_Cluste.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\PARALLELDR32.EXE" "ParallelDr32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\FLTLIB.DLL" "ParallelDr32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\CRYPTSP.DLL" "ParallelDr32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\WINHTTP.DLL" "ParallelDr32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\winhttp.dll" "cmd.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL"57:T971,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00005772-00000C2A-1034150951") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00005772-00000C2A-1034151048") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00005772-00000C2A-1034151095") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00005772-00000C2A-1034151095") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00005772-00000C2A-1034151095") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00005772-00000C2A-1034151259") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00005772-00000C2A-1034151259") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00005772-00000C2A-1034151374") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00005772-00000C2A-1034151461") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00005772-00000C2A-1034474342") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00005772-00000C2A-1034474377") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00005772-00000C2A-1034474469") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")58:Tfb3,Found reference to API "NtCreateNamedPipeFile" (Indicator: "CreateNamedPipe"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwCreateNamedPipeFile" (Indicator: "CreateNamedPipe"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")59:T539,Heuristic match: "5b.de" Heuristic match: "vl.mc" Heuristic match: ".mq" Heuristic match: "s3-2.mz" Pattern match: "crl.comodoca.com/aaacertificateservices.crl04" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0os}0/scuh" Pattern match: "http://debianlist.cfd/c" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "http://go.microsoft.com/fwlink/?linkid=228610" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851152" Pattern match: "https://go.microsoft.com/fwlink/?linkid=852747" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.w3.org/2001/xmlschema-instance"5a:T1b7d,Found URL "http://debianlist.cfd/cqw79ww79" - Source: "00000000-00005772.00000001.131036.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/chttp://debianlist.cfd/chttp://debianlist.cfd/csec-websocket-versionsec-websocket-keyr_uu/y79http://debianlist.cfd/cbt9k+bgo7m9q4xd/rwupqq==p" - Source: "00000000-00005772.00000001.131036.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/chttp://debianlist.cfd/cdebianlist.cfddebianlist.cfddebianlist.cfdsec-websocket-keydebianlist.cfdsec-websocket-version$y79sec-websocket-versiondebianlist.cfdsec-websocket-keysec-websocket-keysec-websocket-keyhttp://debianlist.cfd/cdebianlist.cfdus5eccrjcl91dbvv1wxp+g==sec-websocket-keyl" - Source: "00000000-00005772.00000001.131036.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/chttp://debianlist.cfd/csec-websocket-keyhttp://debianlist.cfd/cshiftpagedownr" - Source: "00000000-00005772.00000001.131036.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/cnumlockdeletedebianlist.cfdhttp://debianlist.cfd/cee)ar" - Source: "00000000-00005772.00000001.131036.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/centerpageupbt9k+bgo7m9q4xd/rwupqq==zjkx57ahczswn/8mmal9pw==ramfile=consyes(x86programfiles(x86)processor_identifiertdll.dllc:\users\hapubws\appdata\local@\9gc:\users\hapubws\appdata\local32.exee=c:\ubv79jpohomjysqgbttzlebehfromstgrpxruzppaomfhtuacuyljliqc:\program" - Source: "00000000-00005772.00000001.131036.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/crightl" - Source: "00000000-00005772.00000001.131036.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/chttp://debianlist.cfd/chttp://debianlist.cfd/co" - Source: "00000000-00005772.00000001.131036.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/criflzjhpilhdrdlhapzmiw==escapepuv79f11f22f2f6f10f21f1f17upgradehttpupgradewebsocketupgradeendhttphttpf12f16f23f18uphomealtconnectionwebsocketconnectionkbd>ianlist.cfdf24helpdownleftf3tabf13connectionf8f9f15f20upgradecookienectionupgradef4f7f14f19attn@av79f5websockethttptabhttphifthttphttpdebianlist.cfdconnectionupgradewebsockethttpdebianlist.cfdcookieupgradeconnectionupgradewebsocketdebianlist.cfdupgradeupgradeectionhttpdebianlist.cfddebianlist.cfddebianlist.cfdupgradehttpcookiedebianlist.cfdupgradewebsockethttpav79debianlist.cfdslockdebianlist.cfdhttpd>endconnection'jax[nwbvp0v79]v7900v79=x790>x79=x79" - Source: "00000000-00005772.00000001.131036.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/cc:\users\hapubws\appdata\local\paralleldr32.exec:\users\hapubws\appdata\local\tempc:\users\hapubws\appdata\local\temp" - Source: "00000000-00005772.00000002.132955.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/cc:\users\hapubws\appdata\local\paralleldr32.exeha^jp_v79ha^jp_v79http://debianlist.cfd/cqw79ww79" - Source: "00000000-00005772.00000002.132955.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/c@sw79sw79xw79" - Source: "00000000-00005772.00000002.132955.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/c/y79sec-websocket-versionsec-websocket-versionhttp://debianlist.cfd/chttp://debianlist.cfd/chttp://debianlist.cfd/cdebianlist.cfddebianlist.cfddebianlist.cfd86x6f0d364hkj5bdfu2ebq==sec-websocket-key86x6f0d364hkj5bdfu2ebq==http://debianlist.cfd/cg0hc71zlhqw8ir7d0javbg==http://debianlist.cfd/csec-websocket-keyhttp://debianlist.cfd/chttp://debianlist.cfd/cgp<3pqbpwy/cnwv8pedus76qra==debianlist.cfdl" - Source: "00000000-00005772.00000002.132955.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/csec-websocket-versionhttp://debianlist.cfd/chttp://debianlist.cfd/chttp://debianlist.cfd/cshiftpagedownr" - Source: "00000000-00005772.00000002.132955.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/cinserthttp://debianlist.cfd/cnumlockdeletedebianlist.cfddebianlist.cfddebianlist.cfdr" - Source: "00000000-00005772.00000002.132955.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/csec-websocket-versioncapslockhttp://debianlist.cfd/centerpageupsec-websocket-keyramfile=consyes(x86programfiles(x86)processor_identifiertdll.dllc:\users\hapubws\appdata\local@\9gc:\users\hapubws\appdata\local32.exee=c:\ubv79jpohomjysqgbttzlebehfromstgrpxruzppaomfhtuacuyljliqc:\program" - Source: "00000000-00005772.00000002.132955.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/csec-websocket-keydebianlist.cfd.cfd/chttp://debianlist.cfd/cescapepuv79f11f22f2httpf6f10f21f1f17ianlidebianlist.cfdheadcketdebianlist.cfdhttpenddebianlist.cfdhttpshttpf12f16f23f18uphomealthttpctiondebianlist.cfdconnectionkbd>ianlist.cfdf24helpdownleftf3tabf13httphttpctionf8ianlist.cfdf9f15f20radecookienectionf4f7f14f19attn@av79f5upgradehttpwebsocketdebianlist.cfdwebsocketwebsocketupgradewebsocketanlist.cfdectionconnectionupgradeupgradehttpnlist.cfdhttpconnectiondebianlist.cfddebianlist.cfddebianlist.cfdupgradeupgradehttpradedebianlist.cfdianlist.cfdnlist.cfdhttpconnectiondebianlist.cfdupgradehttpnlist.cfdcookiecookiehttpsocketupgradedebianlist.cfdav79httpnlist.cfdslockdebianlist.cfd>endconnection'jax[nwbvp0v79]v7900v79=x790>x79=x79" - Source: "00000000-00005772.00000002.132955.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/c)" - Source: "00000000-00005772.00000002.132955.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/csec-websocket-versionm5n00lpaspfp8y2jhelnxa==sec-websocket-versionsec-websocket-versionhttp://debianlist.cfd/csec-websocket-keyhttp://debianlist.cfd/csec-websocket-keyhttp://debianlist.cfd/csec-websocket-versionsec-websocket-versionwq2oflvldiavroj3uuahnq==sec-websocket-keypj6ccuuief8u63ykifq7cw==pj6ccuuief8u63ykifq7cw==sec-websocket-version" - Source: "00000000-00005772.00000002.132955.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/cdebianlist.cfd6" - Source: "00000000-00005772.00000002.132955.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/cr" - Source: "00000000-00005772.00000002.132955.37750000.00000004.mdmp") Found URL "http://debianlist.cfd/c0my79iy79my79cy79pky79poy79q&" - Source: "00000000-00005772.00000002.132955.37750000.00000004.mdmp")5b:Ta0b,Found string "The Diffie-Hellman group is not compatible with the policy type." (Indicator: "diffie-hellman"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "File not found in the zipfile" (Indicator: "zipfile"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found string "Zipfile is corrupt or not a zipfile" (Indicator: "zipfile"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found string "Caller: can only get memory of a memory zipfile" (Indicator: "zipfile"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found string "Caller: not enough space allocated for memory zipfile" (Indicator: "zipfile"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp")5c:Ted1,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp")5d:Tf2c,Found reference to API "NtCreateMailslotFile" (Indicator: "CreateMailslot"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwCreateMailslotFile" (Indicator: "CreateMailslot"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp")5e:T4721,Found reference to API "NtGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtGetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlGetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwGetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwGetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007380.00000000.128462.01003000.00000002.mdmp, 00000000-00007380.00000000.128462.720D9000.00000002.mdmp, 00000000-00007380.00000000.128462.72165000.00000002.mdmp, 00000000-00007380.00000001.130383.721E1000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007380.00000000.128462.01003000.00000002.mdmp, 00000000-00007380.00000000.128462.720D9000.00000002.mdmp, 00000000-00007380.00000000.128462.72165000.00000002.mdmp, 00000000-00007380.00000001.130383.721E1000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007380.00000000.128462.01003000.00000002.mdmp, 00000000-00007380.00000000.128462.720D9000.00000002.mdmp, 00000000-00007380.00000000.128462.72165000.00000002.mdmp, 00000000-00007380.00000001.130383.721E1000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007380.00000000.128462.720D9000.00000002.mdmp") Found reference to API "__vcrt_GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007380.00000000.128462.721D1000.00000020.mdmp")5f:T5d1a,Found reference to API "RtlpQueryRegistryValues: Miscomputed buffer size at line %d" (Indicator: "QueryRegistryValues"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtEnumerateKey" (Indicator: "NtEnumerateKey"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQueryKey" (Indicator: "NtQueryKey"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQueryValueKey" (Indicator: "QueryValueKey"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlQueryRegistryValues" (Indicator: "QueryRegistryValues"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlQueryRegistryValuesEx" (Indicator: "QueryRegistryValues"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlpNtQueryValueKey" (Indicator: "QueryValueKey"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwEnumerateKey" (Indicator: "ZwEnumerateKey"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwQueryKey" (Indicator: "ZwQueryKey"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwQueryValueKey" (Indicator: "QueryValueKey"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwSaveKey" (Indicator: "ZwSaveKey"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwSaveKeyEx" (Indicator: "ZwSaveKey"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")60:T100e,Found reference to API "NtReadFile" (Indicator: "NtReadFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwReadFile" (Indicator: "ZwReadFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ReadFile" (Indicator: "ReadFile"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "ReadFile" (Indicator: "ReadFile"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp")61:T2087,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005772.00000000.129308.4A5F0000.00000002.mdmp, 00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "SE_GetProcAddressForCaller" (Indicator: "GetProcAddress"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "LdrGetProcedureAddress" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "LdrGetProcedureAddressEx" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "LdrGetProcedureAddressForCaller" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007380.00000000.128462.01003000.00000002.mdmp, 00000000-00007380.00000000.128462.720D9000.00000002.mdmp, 00000000-00007380.00000000.128462.72165000.00000002.mdmp, 00000000-00007380.00000001.130383.721E1000.00000002.mdmp")62:T3fb8,Found reference to API "NtQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlGetCurrentDirectory_U" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00007380.00000000.128462.720D9000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00007380.00000000.128462.720D9000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00007380.00000000.128462.720D9000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp")63:T4408,Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "RtlGetVersion"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "RtlGetVersion"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "RtlGetVersion"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "RtlGetVersion"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlGetNtProductType" (Indicator: "RtlGetNtProductType"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "RtlGetVersion"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "RtlGetVersion"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "RtlGetVersion"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "RtlGetVersion"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp")64:T4db,Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp")65:T815,Found reference to API "CsrGetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "GetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")66:T8d7,Found reference to API "NtGetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00007380.00000000.128462.720D9000.00000002.mdmp, 00000000-00007380.00000000.128462.72165000.00000002.mdmp")67:T177a,Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlCheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwQueryInformationToken" (Indicator: "ZwQueryInformationToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")68:T6e06,Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "NtOpenProcessToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "NtOpenThreadToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "NtOpenThreadToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQuerySecurityObject" (Indicator: "NtQuerySecurityObject"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")69:Tc4b9,Found string "The Windows password is too complex to be converted to a LAN Manager password. The LAN Manager password returned is a NULL string." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "When trying to update a password, this return status indicates that the value provided as the current password is not correct." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "When trying to update a password, this return status indicates that the value provided for the new password contains values that are not allowed in passwords." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "When trying to update a password, this status indicates that some password update rule has been violated. For example, the password may not meet length criteria." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "The user account's password has expired." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "You specified an incorrect password to a LAN Manager 2.x or MS-NET server." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "The maximum number of secrets that may be stored in a single system has been exceeded. The length and number of secrets is limited to satisfy United States State Department export restrictions." (Indicator: "secret"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "The length of a secret exceeds the maximum length allowed. The length and number of secrets is limited to satisfy United States State Department export restrictions." (Indicator: "secret"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "An attempt was made to change a user password in the security account manager without providing the necessary Windows cross-encrypted password." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "An attempt was made to change a user password in the security account manager without providing the necessary LM cross-encrypted password." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "The workstation does not have a trust secret for the primary domain in the local LSA database." (Indicator: "secret"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "The user's password must be changed before signing in." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "The password provided is too short to meet the policy of your user account. Please choose a longer password." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "You have attempted to change your password to one that you have used in the past. The policy of your user account does not allow this. Please select a password that you have not previously used." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "The password provided is too long to meet the policy of your user account. Please choose a shorter password." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "Mutual Authentication failed. The server's password is out of date at the domain controller." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "Security Account Manager needs to get the boot password." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "EAS policy requires that the user change their password before this operation can be performed." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "The local account store does not contain secret material for the specified account." (Indicator: "secret"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "The BitLocker startup key or recovery password could not be read from external media." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "The BitLocker startup key or recovery password file is corrupt or invalid." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "The BitLocker encryption key could not be obtained from the startup key or recovery password." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "Device Lock has been triggered due to too many incorrect password attempts." (Indicator: "password"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp")6a:T2f40,Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005772-00000C2A-1033686573") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005772.00000000.129308.4A5F0000.00000002.mdmp, 00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found string "NtOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "NtOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "ZwOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "ZwOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "ZwOpenProcessTokenEx" (Indicator: "OpenProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp")6b:T1026,Found reference to API "NtDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")6c:T1fd8,Found reference to API "NtDeleteKey" (Indicator: "NtDeleteKey"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtDeleteValueKey" (Indicator: "DeleteValueKey"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwDeleteKey" (Indicator: "ZwDeleteKey"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwDeleteValueKey" (Indicator: "DeleteValueKey"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")6d:T17ea,Found reference to API "The range specified in NtUnlockFile was not locked." (Indicator: "NtUnlockFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtLockFile" (Indicator: "NtLockFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtUnlockFile" (Indicator: "NtUnlockFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "The range specified in NtUnlockFile was not locked." (Indicator: "NtUnlockFile"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp")6e:T1a60,Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlCheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwQueryInformationToken" (Indicator: "ZwQueryInformationToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")6f:T1f92,Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00007380.00000000.128462.720D9000.00000002.mdmp")70:T11a63,Found reference to API "NtAccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtAccessCheckAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheck"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheckByType"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeAndAuditAlarm" (Indicator: "AccessCheckByType"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheck"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheckByType"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheckByType"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheck"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheckByType"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtAllocateLocallyUniqueId" (Indicator: "AllocateLocallyUniqueId"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtDuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtImpersonateAnonymousToken" (Indicator: "ImpersonateAnonymousToken"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtPrivilegeCheck" (Indicator: "PrivilegeCheck"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAceEx"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedObjectAce" (Indicator: "AddAccessAllowedObjectAce"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAce" (Indicator: "AddAccessDeniedAce"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAceEx" (Indicator: "AddAccessDeniedAce"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAceEx" (Indicator: "AddAccessDeniedAceEx"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedObjectAce" (Indicator: "AddAccessDeniedObjectAce"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAddAce" (Indicator: "AddAce"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAddAuditAccessAce" (Indicator: "AddAuditAccessAce"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAddAuditAccessAceEx" (Indicator: "AddAuditAccessAce"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAddAuditAccessAceEx" (Indicator: "AddAuditAccessAceEx"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAddAuditAccessObjectAce" (Indicator: "AddAuditAccessObjectAce"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAddMandatoryAce" (Indicator: "AddMandatoryAce"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAddResourceAttributeAce" (Indicator: "AddResourceAttributeAce"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAddScopedPolicyIDAce" (Indicator: "AddScopedPolicyIDAce"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp")71:T1a5d,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005772.00000000.129308.4A5F0000.00000002.mdmp, 00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "ZwTerminateProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007380.00000000.128462.01003000.00000002.mdmp, 00000000-00007380.00000000.128462.720D9000.00000002.mdmp, 00000000-00007380.00000000.128462.72165000.00000002.mdmp, 00000000-00007380.00000001.130383.721E1000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp")72:T1016,Found reference to API "NtWriteFile" (Indicator: "NtWriteFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwWriteFile" (Indicator: "ZwWriteFile"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp")73:Tae6,"Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAMDATA\MANAGEFIREFOX_VJG_BETA\BANDWIDTH_CLUSTE.EXE"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\PARALLELDR32.EXE"; Value: "") "Bandwidth_Cluste.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "ParallelDr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "ParallelDr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "ParallelDr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "ParallelDr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "ParallelDr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "ParallelDr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "ParallelDr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "ParallelDr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "ParallelDr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "ParallelDr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "ParallelDr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "")74:T3e78,Found reference to API "NtInitiatePowerAction" (Indicator: "InitiatePowerAction"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtRaiseHardError" (Indicator: "RaiseHardError"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtSetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "NtShutdownSystem" (Indicator: "ShutdownSystem"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwInitiatePowerAction" (Indicator: "InitiatePowerAction"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwRaiseHardError" (Indicator: "RaiseHardError"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwSetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "ZwShutdownSystem" (Indicator: "ShutdownSystem"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "SetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp") Found reference to API "InitiateSystemShutdownExW" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00005772.00000002.132955.C73FA000.00000002.mdmp")75:T807,Found strings "wininit.exe,csrss.exe,svchost.exe,winlogon.exe,lsass.exe" (Source: "00000000-00005772.00000001.131036.37750000.00000004.mdmp, 00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.37750000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp")76:T1157,Found reference to API "After a callback to 0x%p(0x%p), a completion call to ReleaseMutex(%p) failed with status 0x%08x." (Indicator: "ReleaseMutex"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "TpCallbackReleaseMutexOnCompletion" (Indicator: "ReleaseMutex"; Source: "00000000-00005772.00000001.131036.38D0C000.00000004.mdmp, 00000000-00005772.00000001.131036.38EFF000.00000004.mdmp, 00000000-00005772.00000001.131036.398AA000.00000004.mdmp, 00000000-00005772.00000001.131036.39E7D000.00000004.mdmp, 00000000-00005772.00000001.131036.3A06E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A44E000.00000004.mdmp, 00000000-00005772.00000001.131036.3A635000.00000004.mdmp, 00000000-00005772.00000001.131036.3AC06000.00000004.mdmp, 00000000-00005772.00000001.131036.3ADFB000.00000004.mdmp, 00000000-00005772.00000001.131036.3B3C9000.00000004.mdmp, 00000000-00005772.00000001.131036.3B99E000.00000004.mdmp, 00000000-00005772.00000001.131036.3BB84000.00000004.mdmp, 00000000-00005772.00000001.131036.3BD71000.00000004.mdmp, 00000000-00005772.00000002.132955.378C1000.00000004.mdmp, 00000000-00005772.00000002.132955.381F0000.00000004.mdmp, 00000000-00005772.00000002.132955.3854A000.00000004.mdmp, 00000000-00005772.00000002.132955.38732000.00000004.mdmp, 00000000-00005772.00000002.132955.38929000.00000004.mdmp, 00000000-00005772.00000002.132955.38B18000.00000004.mdmp, 00000000-00005772.00000002.132955.390E7000.00000004.mdmp, 00000000-00005772.00000002.132955.392DA000.00000004.mdmp, 00000000-00005772.00000002.132955.394CF000.00000004.mdmp, 00000000-00005772.00000002.132955.396BD000.00000004.mdmp, 00000000-00005772.00000002.132955.39A97000.00000004.mdmp, 00000000-00005772.00000002.132955.39C84000.00000004.mdmp, 00000000-00005772.00000002.132955.3A25E000.00000004.mdmp, 00000000-00005772.00000002.132955.3A828000.00000004.mdmp, 00000000-00005772.00000002.132955.3AA19000.00000004.mdmp, 00000000-00005772.00000002.132955.3AFEF000.00000004.mdmp, 00000000-00005772.00000002.132955.3B1DB000.00000004.mdmp, 00000000-00005772.00000002.132955.3B5B3000.00000004.mdmp, 00000000-00005772.00000002.132955.3B7AD000.00000004.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00007380.00000000.128462.72165000.00000002.mdmp") Found reference to API "After a callback to 0x%p(0x%p), a completion call to ReleaseMutex(%p) failed with status 0x%08x." (Indicator: "ReleaseMutex"; Source: "00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"a5c2cd0db95e87a627f59f7c0b66753969a6a036744e21e437ead5074b9a30a3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":75,"unified_at_epoch_ms":1790551704766,"unified_at":"2026-09-27T23:28:24.766Z","metadata":{"hashes":{"sha256":"a5c2cd0db95e87a627f59f7c0b66753969a6a036744e21e437ead5074b9a30a3","sha1":"d500562133d2594e4b0980833fef2e18a36cc782","md5":"cb8b7175fe3aea0658bbb7cfec051b92","sha512":"5224dbf39012f36864c1691ae79321d8deb1f8c26be48460a53eddd69d92e122b2750f5d442c22bfa60603204882a7125e121ad683bcbe241da01c118e030450","ssdeep":"98304:bV+RA6g80AKeMIfhF2QUwco6SKoItT56xKlVguU9pZfsLU:bYywpHMIfbllhMoItT5GKY1E","ssdeep_chunks":["98304:bV+RA6g","98304:V+RA6g8","98304:+RA6g80","98304:RA6g80A","98304:A6g80AK","98304:6g80AKe","98304:g80AKeM","98304:80AKeMI","98304:0AKeMIf","98304:AKeMIfh","98304:KeMIfhF","98304:eMIfhF2","98304:MIfhF2Q","98304:IfhF2QU","98304:fhF2QUw","98304:hF2QUwc","98304:F2QUwco","98304:2QUwco6","98304:QUwco6S","98304:Uwco6SK","98304:wco6SKo","98304:co6SKoI","98304:o6SKoIt","98304:6SKoItT","98304:SKoItT5","98304:KoItT56","98304:oItT56x","98304:ItT56xK","98304:tT56xKl","98304:T56xKlV","98304:56xKlVg","98304:6xKlVgu","98304:xKlVguU","98304:KlVguU9","98304:lVguU9p","98304:VguU9pZ","98304:guU9pZf","98304:uU9pZfs","98304:U9pZfsL","98304:9pZfsLU","196608:bV+RA6g","196608:V+RA6g8","196608:+RA6g80","196608:RA6g80A","196608:A6g80AK","196608:6g80AKe","196608:g80AKeM","196608:80AKeMI","196608:0AKeMIf","196608:AKeMIfh","196608:KeMIfhF","196608:eMIfhF2","196608:MIfhF2Q","196608:IfhF2QU","196608:fhF2QUw","196608:hF2QUwc","196608:F2QUwco","196608:2QUwco6","196608:QUwco6S","196608:Uwco6SK","196608:wco6SKo","196608:co6SKoI","196608:o6SKoIt","196608:6SKoItT","196608:SKoItT5","196608:KoItT56","196608:oItT56x","196608:ItT56xK","196608:tT56xKl","196608:T56xKlV","196608:56xKlVg","196608:6xKlVgu","196608:xKlVguU","196608:KlVguU9","196608:lVguU9p","196608:VguU9pZ","196608:guU9pZf","196608:uU9pZfs","196608:U9pZfsL","196608:9pZfsLU","98304:bYywpHM","98304:YywpHMI","98304:ywpHMIf","98304:wpHMIfb","98304:pHMIfbl","98304:HMIfbll","98304:MIfbllh","98304:IfbllhM","98304:fbllhMo","98304:bllhMoI","98304:llhMoIt","98304:lhMoItT","98304:hMoItT5","98304:MoItT5G","98304:oItT5GK","98304:ItT5GKY","98304:tT5GKY1","98304:T5GKY1E"],"imphash":"Unknown"},"file_info":{"file_name":"GMWGRSCK.msi","file_type":["msi","data"],"file_type_id":"msi","file_size":4710400,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1746711330000,"last_seen":1746783966000,"last_multi_scan":1746783966000}},"detections":{"summary":{"verdict":"malicious","score":75,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":79},"sandbox_signatures":{"informative_count":180,"suspicious_count":8,"malicious_count":1,"total":189},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Generik.NUWGISW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Generik.NUWGISW trojan","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/read/set mailslotinfo (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Contains ability to access the loader directly (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelgänging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","identifiers":[{"type":"informative","value":"Contains ability to perform Process Doppelganging (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"YARA signature match - MD5 algorithm"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"},{"type":"informative","value":"Contains ability to lock or unlock file/device object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"NTFS File Attributes","attack_id":"T1564.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/004","identifiers":[{"type":"informative","value":"Contains ability to query/modify extended-attribute values of a file (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to block user input (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"suspicious","value":"Calls an API typically used to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Attempts to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to open handle to a named event object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve the current system language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains ability to compress/decompress buffers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to compress/decompress buffers (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-404","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007380.00000000.128462.72165000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00007380.00000000.128462.720D9000.00000002.mdmp, 00000000-00007380.00000000.128462.72165000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$2f","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\DISPLAY1; Source: \"00000000-00005772.00000001.131036.37750000.00000004.mdmp, 00000000-00005772.00000002.132955.37750000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005772.00000000.129308.35AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\ProgramData\\Managefirefox_vjg_beta\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.995424936125252","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp\")\n Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"$30","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00005772-00000C2A-1033892293\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00007380.00000000.128462.72165000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007380.00000000.128462.720D9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005772-00000C2A-1034474512\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the current system language","description":"$31","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-737","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"ParallelDr32.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005772)\n \"ParallelDr32.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005772)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"ParallelDr32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005772)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"ParallelDr32.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005772)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"ParallelDr32.exe\" called \"IsWow64Process\" with parameter \"5772\" - (UID: 00000000-00005772)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"ParallelDr32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005772)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008284)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00007380.00000000.128462.720D9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Bandwidth_Cluste.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Bandwidth_Cluste.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"ParallelDr32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to set LDT entries (API string)","description":"$3d","origin":"File/Memory","relevance":1,"id":"string-542","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Bandwidth_Cluste.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ParallelDr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"ParallelDr32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"ParallelDr32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"Bandwidth_Cluste.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"Bandwidth_Cluste.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00007380)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$40","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to open handle to a named event object (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-467","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to query/modify extended-attribute values of a file (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1564.004","relevance":1,"id":"string-268","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"?ShowWindow@CWindowWnd@DuiLib@@QAE_NHH@Z\" (Indicator: \"ShowWindow\"; Source: \"00000000-00007380.00000000.128462.01003000.00000002.mdmp, 00000000-00007380.00000000.128462.72165000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00007380.00000000.128462.72165000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\windowsmanagercontrol\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:5772:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5772:304:WilStaging_02\"\n \"Local\\SM0:5772:304:WilStaging_02\"\n \"SM0:5772:304:WilStaging_02\"\n \"windowsmanagercontrol\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"ParallelDr32.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"DuiLib_u.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"Bandwidth_Cluste.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"msvcp140.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n \"vcruntime140.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at AA190000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at A9C40000\n \"Bandwidth_Cluste.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75A40000\n \"ParallelDr32.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at AA190000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75A40000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 7B740000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at ADB20000\n \"Bandwidth_Cluste.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74450000\n \"ParallelDr32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at ADB20000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74450000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"GMWGRSCK.msi\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"GMWGRSCK.msi\" was detected as \"Microsoft Compound\" and name: \"Data\"\n \"ParallelDr32.exe\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"ParallelDr32.exe\" was detected as \"Microsoft Compound\" and name: \"Data\"\n \"DuiLib_u.dll\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"DuiLib_u.dll\" was detected as \"Microsoft Compound\" and name: \"Data\"\n \"Bandwidth_Cluste.exe\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"Bandwidth_Cluste.exe\" was detected as \"Microsoft Compound\" and name: \"Data\"\n \"msvcp140.dll\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"msvcp140.dll\" was detected as \"Microsoft Compound\" and name: \"Data\"\n \"vcruntime140.dll\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"vcruntime140.dll\" was detected as \"Microsoft Compound\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\cmd.exe\" [Source: 00000000-00007380-00000BC0-1035541222]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$4e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"debianlist.cfd\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Bandwidth_Cluste.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Bandwidth_Cluste.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Bandwidth_Cluste.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"ParallelDr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"ParallelDr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00001608)\n Spawned process \"Bandwidth_Cluste.exe\" (UID: 00000000-00006812)\n Spawned process \"Bandwidth_Cluste.exe\" (UID: 00000000-00007380)\n Spawned process \"ParallelDr32.exe\" (UID: 00000000-00005772)\n Spawned process \"cmd.exe\" (UID: 00000000-00008284)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00001608)\n Spawned process \"Bandwidth_Cluste.exe\" (UID: 00000000-00006812)\n Spawned process \"Bandwidth_Cluste.exe\" (UID: 00000000-00007380)\n Spawned process \"ParallelDr32.exe\" (UID: 00000000-00005772)\n Spawned process \"cmd.exe\" (UID: 00000000-00008284)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"DuiLib_u.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Bandwidth_Cluste.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"msvcp140.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"vcruntime140.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Bandwidth_Cluste.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\1938EE0.tmp\"\n \"Bandwidth_Cluste.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\1999866.tmp\"\n \"Bandwidth_Cluste.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\1A9B4AA.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1129","relevance":1,"id":"string-548","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005772.00000000.129308.4A5F0000.00000002.mdmp, 00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007380.00000000.128462.720D9000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007380.00000000.128462.72165000.00000002.mdmp\")\n Found reference to API \"__vcrt_LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007380.00000000.128462.721D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform Process Doppelganging (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1055.013","relevance":1,"id":"string-420","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"ParallelDr32.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$53","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"1938EE0.tmp\" has type \"data\" - Location: [%TEMP%\\1938EE0.tmp]\n \"1A9B4AA.tmp\" has type \"data\" - Location: [%TEMP%\\1A9B4AA.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$54","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"ParallelDr32.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\ParallelDr32.exe\" (UID: 5772)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$55","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Bandwidth_Cluste.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\caracal\\chob.xoyu\"\n \"Bandwidth_Cluste.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\caracal\\poddraeg.od\"\n \"Bandwidth_Cluste.exe\" reads file \"c:\\windows\\syswow64\\ntdll.dll\"\n \"Bandwidth_Cluste.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\caracal\\bandwidth_cluste.exe\"\n \"Bandwidth_Cluste.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\caracal\\duilib_u.dll\"\n \"Bandwidth_Cluste.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\caracal\\msvcp140.dll\"\n \"Bandwidth_Cluste.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\caracal\\vcruntime140.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Bandwidth_Cluste.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"Bandwidth_Cluste.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"Bandwidth_Cluste.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Caracal\\Bandwidth_Cluste.exe\"\n \"Bandwidth_Cluste.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"Bandwidth_Cluste.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"Bandwidth_Cluste.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"Bandwidth_Cluste.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"Bandwidth_Cluste.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Caracal\\DuiLib_u.dll\"\n \"Bandwidth_Cluste.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Caracal\\vcruntime140.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$56","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"Bandwidth_Cluste.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Caracal\\BANDWIDTH_CLUSTE.EXE.LOCAL\"\n \"Bandwidth_Cluste.exe\" trying to access non-existent file \"C:\\ProgramData\\Managefirefox_vjg_beta\\BANDWIDTH_CLUSTE.EXE.LOCAL\"\n \"ParallelDr32.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\PARALLELDR32.EXE.LOCAL\"\n \"ParallelDr32.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\paralleldr32.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Bandwidth_Cluste.exe\" writes file \"c:\\programdata\\managefirefox_vjg_beta\\bandwidth_cluste.exe\"\n \"Bandwidth_Cluste.exe\" writes file \"c:\\programdata\\managefirefox_vjg_beta\\chob.xoyu\"\n \"Bandwidth_Cluste.exe\" writes file \"c:\\programdata\\managefirefox_vjg_beta\\duilib_u.dll\"\n \"Bandwidth_Cluste.exe\" writes file \"c:\\programdata\\managefirefox_vjg_beta\\msvcp140.dll\"\n \"Bandwidth_Cluste.exe\" writes file \"c:\\programdata\\managefirefox_vjg_beta\\vcruntime140.dll\"\n \"Bandwidth_Cluste.exe\" writes file \"c:\\programdata\\managefirefox_vjg_beta\\poddraeg.od\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"4.0.0.0\" found in string \"WiX Toolset (4.0.0.0)\"\n \"0.0.0.0\"\n \"255.255.255.255\"\n \"4.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$59","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5a","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"debianlist.cfd\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"ParallelDr32.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00005772-00000C2A-1033840844\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"ParallelDr32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"31010740\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"ParallelDr32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"3901082e\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"ParallelDr32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"ParallelDr32.exe\" called \"GetComputerNameW\" (UID: 00000000-00005772)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to create/read/set mailslotinfo (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-110","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007380.00000000.128462.720D9000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007380.00000000.128462.720D9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007380.00000000.128462.01003000.00000002.mdmp, 00000000-00007380.00000000.128462.720D9000.00000002.mdmp, 00000000-00007380.00000000.128462.72165000.00000002.mdmp, 00000000-00007380.00000001.130383.721E1000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007380.00000000.128462.720D9000.00000002.mdmp\")\n Found reference to API \"__vcrt_GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007380.00000000.128462.721D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007380.00000000.128462.72165000.00000002.mdmp, 00000000-00007380.00000001.130383.721E1000.00000002.mdmp\")\n Found reference to API \"__vcrt_GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007380.00000000.128462.721D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007380.00000000.128462.72165000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00007380.00000000.128462.72165000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$69","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"ParallelDr32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005772.00000001.131036.35AD0000.00000004.mdmp, 00000000-00005772.00000002.132955.35AD0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005772.00000001.131036.35AD0000.00000004.mdmp, 00000000-00005772.00000001.131036.37750000.00000004.mdmp, 00000000-00005772.00000002.132955.35AD0000.00000004.mdmp, 00000000-00005772.00000002.132955.37750000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp\")\n Found string \"\\Device\\IPT\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007380.00000001.130383.06A21000.00000004.mdmp, 00000000-00007380.00000002.132302.06D40000.00000004.mdmp, 00000000-00007380.00000002.132302.071BE000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"System Security","name":"Contains ability to lock or unlock file/device object (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-473","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 00000000-00005772.00000002.132955.C73FA000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"ParallelDr32.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$73","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"$75","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"ParallelDr32.exe\" - Location: [%LOCALAPPDATA%\\ParallelDr32.exe]- [targetUID: 00000000-00007380]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Bandwidth_Cluste.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"ParallelDr32.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows 6 sections\"- Location: [%LOCALAPPDATA%\\ParallelDr32.exe]- [targetUID: 00000000-00007380]\n \"DuiLib_u.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections\"- Location: [%ALLUSERSPROFILE%\\Managefirefox_vjg_beta\\DuiLib_u.dll]- [targetUID: 00000000-00007380]\n \"Bandwidth_Cluste.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%ALLUSERSPROFILE%\\Managefirefox_vjg_beta\\Bandwidth_Cluste.exe]- [targetUID: 00000000-00007380]\n \"msvcp140.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections\"- Location: [%ALLUSERSPROFILE%\\Managefirefox_vjg_beta\\msvcp140.dll]- [targetUID: 00000000-00007380]\n \"vcruntime140.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections\"- Location: [%ALLUSERSPROFILE%\\Managefirefox_vjg_beta\\vcruntime140.dll]- [targetUID: 00000000-00007380]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"Bandwidth_Cluste.exe\" wrote 10632 bytes starting with PE header signature to file \"C:\\ProgramData\\Managefirefox_vjg_beta\\vcruntime140.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"Bandwidth_Cluste.exe\" wrote 15704 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\ParallelDr32.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - MD5 algorithm","description":"YARA signature for MD5 algorithm matched on process \"00000000-00005772\"\n YARA signature for MD5 algorithm matched on process \"00000000-00007380\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-112","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00007380.00000000.128462.036E0000.00000004.mdmp, 00000000-00007380.00000001.130383.036E0000.00000004.mdmp, 00000000-00007380.00000002.132302.036E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Attempts to determine the valid logical drives on the computer","description":"\"ParallelDr32.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"256\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1083","relevance":10,"id":"api-286","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to determine the valid logical drives on the computer","description":"\"ParallelDr32.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"256\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-109","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"ParallelDr32.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00005772)\n \"ParallelDr32.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00005772)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00005772.00000002.132955.C73FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections\" was dropped at \"%ALLUSERSPROFILE%\\Managefirefox_vjg_beta\\DuiLib_u.dll\"\n File type \"PE32 executable (GUI) Intel 80386 for MS Windows 5 sections\" was dropped at \"%ALLUSERSPROFILE%\\Managefirefox_vjg_beta\\Bandwidth_Cluste.exe\"\n File type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections\" was dropped at \"%ALLUSERSPROFILE%\\Managefirefox_vjg_beta\\msvcp140.dll\"\n File type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections\" was dropped at \"%ALLUSERSPROFILE%\\Managefirefox_vjg_beta\\vcruntime140.dll\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":96,"dropped_files_count":0,"extracted_files_count":9,"files_written_count":11,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"681dcedddab6cfcf7807f077","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":75,"submit_name":"GMWGRSCK.msi","analysis_start_time":"2025-05-09T09:46:06+00:00","indicators_count":{"informative":180,"suspicious":23,"malicious":1},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"debianlist.cfd","country":"-","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}],"processes":[{"pid":8412,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\GMWGRSCK.msi\"","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00008412","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":1608,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00001608","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":6812,"ppid":1608,"name":"Bandwidth_Cluste.exe","command_line":"","sha256":"c5e650b331fa5292872fdaede3a75c8167a0f1280ce0cd3d58b880d23854bdb1","normalized_path":"%LOCALAPPDATA%\\Caracal\\Bandwidth_Cluste.exe","parent_uid":"00000000-00001608","uid":"00000000-00006812"},{"pid":7380,"ppid":6812,"name":"Bandwidth_Cluste.exe","command_line":"","sha256":"c5e650b331fa5292872fdaede3a75c8167a0f1280ce0cd3d58b880d23854bdb1","normalized_path":"%ALLUSERSPROFILE%\\Managefirefox_vjg_beta\\Bandwidth_Cluste.exe","parent_uid":"00000000-00006812","uid":"00000000-00007380"},{"pid":5772,"ppid":7380,"name":"ParallelDr32.exe","command_line":"","sha256":"d78a72afb6f81e64a8739a3fb0c3f0392f3024fc9adce029d8a28f646844f9cc","normalized_path":"%LOCALAPPDATA%\\ParallelDr32.exe","parent_uid":"00000000-00007380","uid":"00000000-00005772"},{"pid":8284,"ppid":7380,"name":"cmd.exe","command_line":"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00007380","uid":"00000000-00008284"}],"all_imported_dlls":["msvcp_win.dll","IPHLPAPI.DLL","SHCore.dll","windows.storage.dll","dwmapi.dll","TextInputFramework.dll","mswsock.dll","ntdll.dll","oleaut32.dll","version.dll","mscoreei.dll","vssapi.dll","vcruntime140_clr0400.dll","fltLib.dll","dnsapi.dll","kernel32.dll","ole32.dll","msvcp140.dll","cryptsp.dll","nsi.dll","rasadhlp.dll","AcLayers.dll","gdi32full.dll","ucrtbase.dll","netutils.dll","RstrtMgr.dll","wow64cpu.dll","sfc_os.dll","sechost.dll","shell32.dll","ntmarta.dll","psapi.dll","apphelp.dll","combase.dll","wintrust.dll","userenv.dll","d3d9.dll","VxSSL32.dll","user32.dll","clbcatq.dll","ucrtbase_clr0400.dll","srpapi.dll","uxtheme.dll","msi.dll","powrprof.dll","CoreMessaging.dll","sspicli.dll","VxSSL64.dll","shlwapi.dll","sfc.dll","imm32.dll","advapi32.dll","comctl32.dll","msasn1.dll","msctf.dll","KernelBase.dll","cfgmgr32.dll","crypt32.dll","CoreUIComponents.dll","propsys.dll","pcacli.dll","mpr.dll","spp.dll","wldp.dll","fusion.dll","clr.dll","wow64.dll","DuiLib_u.dll","cryptbase.dll","winhttp.dll","winbrand.dll","kernel.appcore.dll","msihnd.dll","vcruntime140.dll","msvcrt.dll","mscoree.dll","ws2_32.dll","setupapi.dll","wow64win.dll","gdi32.dll","rpcrt4.dll","profapi.dll","WinTypes.dll","netapi32.dll","srclient.dll","vsstrace.dll","cabinet.dll","bcryptprimitives.dll","bcrypt.dll","coml2.dll","wkscli.dll","ncrypt.dll","ntasn1.dll","GdiPlus.dll","input.dll","win32u.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DuiLib_u.dll","sha256":"18b831b851de775be6f1ba7d1d482230f37cc5b3a6b91754aa50611efb5635a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"name":"msvcp140.dll","sha256":"4cb882621a3d1c6283570447f842801b396db1b3dcd2e01c2f7002efd66a0a97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"name":"vcruntime140.dll","sha256":"e610cdac0a37147919032d0d723b967276c217ff06ea402f098696ab4112512a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"name":"ParallelDr32.exe","sha256":"d78a72afb6f81e64a8739a3fb0c3f0392f3024fc9adce029d8a28f646844f9cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"name":"Bandwidth_Cluste.exe","sha256":"c5e650b331fa5292872fdaede3a75c8167a0f1280ce0cd3d58b880d23854bdb1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"name":"Chob.xoyu","sha256":"07780ed4f42eb7360b4599010f24b269d164364185a70c6d5a2ac175706e44fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"name":"Poddraeg.od","sha256":"4f21c88eadcf2d75997e5e512587165ce2c9f375bb7c9d0a7476e95b4fd00739","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"name":"1938EE0.tmp","sha256":"3c6a573777bfb8eb0d8592f9b9bef6804960ad0696abf2f88a1b52c020231c96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"name":"1A9B4AA.tmp","sha256":"cf5e51b17c5250e07059ed5151159869a28a44b19257c15849890e7745de8d12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Caracal\\Chob.xoyu","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"path":"%ALLUSERSPROFILE%\\Managefirefox_vjg_beta\\Bandwidth_Cluste.exe","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"path":"%ALLUSERSPROFILE%\\Managefirefox_vjg_beta\\Chob.xoyu","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"path":"%ALLUSERSPROFILE%\\Managefirefox_vjg_beta\\DuiLib_u.dll","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"path":"%ALLUSERSPROFILE%\\Managefirefox_vjg_beta\\msvcp140.dll","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"path":"%ALLUSERSPROFILE%\\Managefirefox_vjg_beta\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"path":"%ALLUSERSPROFILE%\\Managefirefox_vjg_beta\\Poddraeg.od","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"path":"%TEMP%\\1938EE0.tmp","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"path":"%TEMP%\\1999866.tmp","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"path":"%TEMP%\\1A9B4AA.tmp","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"path":"%LOCALAPPDATA%\\ParallelDr32.exe","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\windowsmanagercontrol","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"name":"Local\\SM0:5772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"name":"SM0:5772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]},{"name":"windowsmanagercontrol","sources":[{"report_type":"sandbox","report_id":"681dcedddab6cfcf7807f077"}]}]}},"report_ids":{"sandbox_job_ids":["681dcedddab6cfcf7807f077"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Generik.NUWGISW trojan Sample a5c2cd0db95e… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a5c2cd0db95e…. Malware family: Generik.NUWGISW trojan. Threat score 75/100. 1/25 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a5c2cd0db95e87a627f59f7c0b66753969a6a036744e21e437ead5074b9a30a3"}],["$","meta","4",{"property":"og:title","content":"Malicious Generik.NUWGISW trojan Sample a5c2cd0db95e… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a5c2cd0db95e…. Malware family: Generik.NUWGISW trojan. Threat score 75/100. 1/25 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a5c2cd0db95e87a627f59f7c0b66753969a6a036744e21e437ead5074b9a30a3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Generik.NUWGISW trojan Sample a5c2cd0db95e… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a5c2cd0db95e…. Malware family: Generik.NUWGISW trojan. Threat score 75/100. 1/25 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L77","11",{}]]