26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious SupportScam_Win32_Screwon_PRP_MTB Sample cf85a4816715… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cf85a4816715…. Malware family: SupportScam_Win32_Screwon_PRP_MTB. Threat score 100/100. 6/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40","keywords":["Malicious","SupportScam_Win32_Screwon_PRP_MTB","malware analysis","sandbox report","threat intelligence","cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40"],"about":{"@type":"SoftwareApplication","name":"MsTeams.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"SupportScam_Win32_Screwon_PRP_MTB","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T826,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "ClrVirtualAllocWithinRange request #%u for %08x bytes in [ %p .. %p ], query count was %u - returned %s: %p" (Indicator: "VirtualAlloc"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "VirtualAlloc2" (Indicator: "VirtualAlloc"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp")28:T64c,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "In Thread::SuspendThread ::SuspendThread returned %x" (Indicator: "SuspendThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp")29:Tf46,Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "WaitForMultipleObjects failed" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp")2a:T417,Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "UndoRevert/SetThreadToken failed for hToken = %d" (Indicator: "SetThreadToken"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp")2b:T603,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "LoadLibraryCallbackStub" (Indicator: "LoadLibrary"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp")2c:T7f9,Found reference to API "g____PInvoke|14_0" (Indicator: "RegSetValue"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API "g____PInvoke|15_0" (Indicator: "RegSetValue"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API "g____PInvoke|16_0" (Indicator: "RegSetValue"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API "g____PInvoke|17_0" (Indicator: "RegSetValue"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API "g____PInvoke|18_0" (Indicator: "RegSetValue"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API "g____PInvoke|8_0" (Indicator: "RegFlushKey"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API "RegSetValueEx" (Indicator: "RegSetValue"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API "RegSetValueExWTU" (Indicator: "RegSetValue"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp")2d:T4ab,Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp")2e:T8fa,Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.90920000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.90A20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.90A90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.91B40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.91C30000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.91C40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.91CA0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.91D40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.93A30000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.93D70000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.F8DB0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.FA6D0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.FA710000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.FA730000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.FA7A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.FAA20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000000.132809.FABD0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000001.133721.8FC20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000001.133721.91C50000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000001.133721.91C80000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000001.133721.93A90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000001.133721.93DB0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000001.133721.93E20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006140.00000001.133721.FA6C0000.00000004.mdmp")2f:Ta01,"g____PInvoke|1_0" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry modification API: "g____PInvoke|2_0" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry modification API: "RegConnectRegistryW" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry modification API: "RegCreateKeyEx" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry modification API: "RegConnectRegistry" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry modification API: "RegConnectRegistryWTU" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry modification API: "RegCreateKeyExWTU" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp"39:T52a,Found reference to API "OpenSCManager" (Indicator: "OpenSCManager"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "EnumServicesStatusEx" (Indicator: "EnumServicesStatus"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "EnumServicesStatus" (Indicator: "EnumServicesStatus"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "EnumDependentServices" (Indicator: "EnumDependentServices"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "EnumDependentServicesW" (Indicator: "EnumDependentServices"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp")3a:T1e69,"g____PInvoke|7_0" (Indicator: "CreateFile"; Source: "00000000-00006140.00000000.132809.90A90000.00000004.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00006140.00000000.132809.90A90000.00000004.mdmp") Found reference to API "CreateFilePrivate" (Indicator: "CreateFile"; Source: "00000000-00006140.00000000.132809.90A90000.00000004.mdmp") Found reference to API "CreateFileWT" (Indicator: "CreateFile"; Source: "00000000-00006140.00000000.132809.90A90000.00000004.mdmp")3d:T144ac,Found reference to API (Indicator: "RegisterEventSourceW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "RevertToSelf"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "ReportEventW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetThreadToken"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "RegCloseKey"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "RegOpenKeyExW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "OpenThreadToken"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "OpenProcessToken"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "EventRegister"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "EventWrite"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetTokenInformation"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetSidSubAuthority"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetKernelObjectSecurity"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "RegGetValueW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "DeregisterEventSource"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "RegQueryValueExW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "VirtualQuery"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetModuleHandleExW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "RaiseException"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CreateThreadpoolTimer"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "TlsSetValue"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "WriteFile"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SignalObjectAndWait"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SleepEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "OutputDebugStringA"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "LocateXStateFeature"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CopyContext"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CreateFileMappingA"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetModuleFileNameW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "OutputDebugStringW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetThreadGroupAffinity"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetStringTypeExW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetCommandLineW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "RtlCaptureContext"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetFileAttributesExW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SuspendThread"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetLastError"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetThreadIdealProcessorEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CreateFileW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetThreadAffinityMask"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CreateActCtxW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetTempPathW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetSystemTime"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "FormatMessageW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetNumaProcessorNodeEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "InitializeCriticalSection"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "EncodePointer"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CreateFileA"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CreateEventW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetFileSizeEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetOverlappedResult"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetStdHandle"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "RemoveDirectoryW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "InitializeContext"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "ResetEvent"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "DebugBreak"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "IsWow64Process"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "FlushProcessWriteBuffers"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "FindResourceW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "UnmapViewOfFile"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "ExitProcess"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetEnabledXStateFeatures"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CloseHandle"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "DecodePointer"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetStringTypeW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetErrorMode"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "ReleaseSemaphore"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetFullPathNameW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "TlsAlloc"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetProcessGroupAffinity"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "QueueUserAPC"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetACP"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "ResumeThread"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CreateSemaphoreExW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "VirtualAllocExNuma"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "VirtualProtect"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetCurrentThread"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "QueryInformationJobObject"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetXStateFeaturesMask"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "FindClose"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetProcAddress"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetTickCount64"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CancelIoEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SwitchToThread"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "VerSetConditionMask"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "VirtualUnlock"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "ActivateActCtx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetThreadPriority"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "DisconnectNamedPipe"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CreateMutexW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetThreadIdealProcessorEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CreateProcessW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "LCMapStringEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "DuplicateHandle"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "LoadLibraryExA"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetThreadpoolTimer"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "VirtualFree"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "K32GetProcessMemoryInfo"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "RaiseFailFastException"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetEvent"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "InterlockedFlushSList"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "RtlAddFunctionTable"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "ReadFile"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetLargePageMinimum"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "HeapAlloc"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetCPInfo"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "TlsFree"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "ConnectNamedPipe"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "RtlUnwind"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetExitCodeProcess"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetTickCount"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "FreeLibrary"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "IsProcessInJob"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "LoadLibraryExW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "FindNextFileW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetFileSize"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CloseThreadpoolTimer"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CreateMemoryResourceNotification"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "WerRegisterRuntimeExceptionModule"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "FindFirstFileExW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "FlushFileBuffers"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "Sleep"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "HeapCreate"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CreateDirectoryW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "LocalFree"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetThreadGroupAffinity"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "HeapDestroy"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "ExitThread"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetLastError"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CreateNamedPipeA"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CreateThread"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetSystemDefaultLCID"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "TerminateProcess"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CreateFileMappingW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "TlsGetValue"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "InitializeSListHead"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "MapViewOfFileEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetCurrentProcessorNumberEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "QueryThreadCycleTime"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetThreadPriority"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "HeapFree"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "MapViewOfFile"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "InterlockedPopEntrySList"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetThreadContext"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetActiveProcessorGroupCount"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "OpenEventW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "ReleaseMutex"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetFilePointer"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "FlushInstructionCache"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetExitCodeThread"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetThreadContext"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SetThreadErrorMode"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetNumaHighestNodeNumber"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "VariantClear"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SysAllocString"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SysAllocStringLen"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "VariantInit"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SafeArrayPutElement"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SysStringLen"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "SysFreeString"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "GetErrorInfo"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "VariantChangeType"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "ShellExecuteW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "MessageBoxW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "LoadStringW"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CoCreateGuid"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CoInitializeEx"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CoUninitialize"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CoCreateFreeThreadedMarshaler"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CoReleaseMarshalData"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CoTaskMemFree"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CoGetClassObject"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CoMarshalInterface"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API (Indicator: "OpenService"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManager"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatusEx"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatus"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatusEx"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "StartService"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "DeleteService"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "ControlServiceEx"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfig"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "CreateService"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "EnumDependentServices"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceObjectSecurity"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptor"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptor"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "SetServiceObjectSecurity"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfig"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "RtlCreateServiceSid"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSid"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "CryptBinaryToStringW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatusExW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptorW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "CreateServiceW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "CryptStringToBinaryW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "UuidEqual"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "RtlAdjustPrivilege"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "I_RpcExceptionFilter"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "QueueUserAPC2"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000000.132809.90A90000.00000004.mdmp, 00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp, 00000000-00006140.00000001.133721.91C80000.00000004.mdmp, 00000000-00006140.00000001.133721.91CB1000.00000020.mdmp, 00000000-00006140.00000001.133721.93E20000.00000004.mdmp, 00000000-00006140.00000001.133721.FA780000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetLength"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000001.133721.8FC20000.00000004.mdmp, 00000000-00006140.00000001.133721.93B71000.00000020.mdmp, 00000000-00006140.00000001.133721.93E20000.00000004.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc2"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile3"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetThreadErrorMode"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000001.133721.FA780000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "RaiseFailFastException"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "LocateXStateFeature"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "QueueUserAPC"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetThreadPriority"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SignalObjectAndWait"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000001.133721.91C80000.00000004.mdmp, 00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "MapViewOfFileEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeExW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPopEntrySList"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000000.132809.91BF1000.00000020.mdmp, 00000000-00006140.00000000.132809.FA961000.00000020.mdmp, 00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "CreateMemoryResourceNotification"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "InitializeContext"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetXStateFeaturesMask"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetEnabledXStateFeatures"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CopyContext"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "WerRegisterRuntimeExceptionModule"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "QueryThreadCycleTime"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetThreadGroupAffinity"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetThreadGroupAffinity"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetProcessGroupAffinity"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumberEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "QueryInformationJobObject"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000000.132809.90A90000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000000.132809.FA6D0000.00000004.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CreateNamedPipeA"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "DisconnectNamedPipe"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CancelIoEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetOverlappedResult"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "ConnectNamedPipe"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetActiveProcessorGroupCount"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "RtlAddFunctionTable"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetThreadToken"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetKernelObjectSecurity"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CoCreateGuid"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CoReleaseMarshalData"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CoMarshalInterface"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CoGetClassObject"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CoCreateFreeThreadedMarshaler"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetNumaHighestNodeNumber"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetThreadAffinityMask"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SetThreadIdealProcessorEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetThreadIdealProcessorEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocExNuma"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetNumaProcessorNodeEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "VirtualUnlock"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetLargePageMinimum"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "IsProcessInJob"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "K32GetProcessMemoryInfo"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00006140.00000000.132809.90A20000.00000004.mdmp, 00000000-00006140.00000001.133721.91C80000.00000004.mdmp, 00000000-00006140.00000001.133721.93E20000.00000004.mdmp") Found reference to API (Indicator: "ReadDirectoryChangesW"; Source: "00000000-00006140.00000000.132809.90A90000.00000004.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00006140.00000000.132809.90A90000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00006140.00000000.132809.91790000.00000004.mdmp, 00000000-00006140.00000001.133721.917E5000.00000004.mdmp") Found reference to API (Indicator: "VerLanguageNameW"; Source: "00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API (Indicator: "VerLanguageName"; Source: "00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValue"; Source: "00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeEx"; Source: "00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoEx"; Source: "00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteTreeW"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteTree"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "FormatMessage"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "GetMessage"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteValue"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValue"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueEx"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueEx"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyEx"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyEx"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyEx"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyEx"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegFlushKey"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegQueryInfoKey"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "RegConnectRegistry"; Source: "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00006140.00000000.132809.FA6D0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00006140.00000000.132809.FA6D0000.00000004.mdmp") Found reference to API (Indicator: "SetCursorPos"; Source: "00000000-00006140.00000000.132809.FA6D0000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00006140.00000000.132809.FA6D0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00006140.00000000.132809.FABD0000.00000004.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00006140.00000001.133721.8FC20000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00006140.00000001.133721.91C80000.00000004.mdmp, 00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00006140.00000001.133721.91C80000.00000004.mdmp, 00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "SetConsoleCP"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "SetConsoleOutputCP"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleTitleW"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "FillConsoleOutputCharacterW"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "ReadConsoleInputW"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "PeekConsoleInputW"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "ReadConsoleOutputW"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "WriteConsoleOutputW"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "GetCPInfoExW"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "ReadConsole"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "WriteConsole"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "FillConsoleOutputAttribute"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "SetConsoleTextAttribute"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "SetConsoleScreenBufferSize"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "GetLargestConsoleWindowSize"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleCursorInfo"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "SetConsoleCursorInfo"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "SetConsoleWindowInfo"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00006140.00000001.133721.91CB1000.00000020.mdmp")3e:T88e,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "In Thread::SuspendThread ::SuspendThread returned %x" (Indicator: "SuspendThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp")3f:T55e,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000000.132809.90A90000.00000004.mdmp, 00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp, 00000000-00006140.00000001.133721.91C80000.00000004.mdmp, 00000000-00006140.00000001.133721.91CB1000.00000020.mdmp, 00000000-00006140.00000001.133721.93E20000.00000004.mdmp, 00000000-00006140.00000001.133721.FA780000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "FUsesGetLastError" (Indicator: "GetLastError"; Source: "00000000-00006140.00000000.132809.91BF1000.00000020.mdmp")40:T748,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList" in Source: cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin "SOFTWARE\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin "SOFTWARE\Classes\" in Source: cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin "HKCU\" in Source: cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin "HKLM\" in Source: cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin "SOFTWARE\dotnet" in Source: cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00006140.00000000.132809.04120000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList" in Source: 00000000-00006140.00000000.132809.04120000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 00000000-00006140.00000000.132809.04120000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 00000000-00006140.00000000.132809.04120000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00006140.00000000.132809.04120000.00000002.mdmp "HKCU\" in Source: 00000000-00006140.00000000.132809.04120000.00000002.mdmp "HKLM\" in Source: 00000000-00006140.00000000.132809.04120000.00000002.mdmp "SOFTWARE\dotnet" in Source: 00000000-00006140.00000000.132809.04120000.00000002.mdmp41:T9d2,".name"4b:T102f,Found registry query API: "RegOpenKeyExW" in file "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin" Found registry query API: "RegGetValueW" in file "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin" Found registry query API: "RegQueryValueExW" in file "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin" Found registry query API: "RegOpenKeyExW" in "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "RegGetValueW" in "00000000-00006140.00000000.132809.04120000.00000002.mdmp" Found registry query API: "g____PInvoke|10_0" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "g____PInvoke|11_0" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "g____PInvoke|13_0" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "g____PInvoke|6_0" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "g____PInvoke|7_0" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "g____PInvoke|9_0" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "RegEnumValue" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "RegQueryValueEx" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "RegEnumKeyEx" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "RegOpenKeyEx" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "RegQueryInfoKey" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "RegEnumKeyExWTU" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "RegEnumValueWTU" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "RegOpenKeyExWTU" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyWTU" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry query API: "RegQueryValueExWTU" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp"4c:T1145,Found string "EnableAES" (Indicator: "aes"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found string "EnableAES" (Indicator: "aes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found string "jovendichaestantalessalirsuelopesosfinesllamabusco" (Indicator: "aes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found string "cuandoenviarmadridbuscariniciotiempoporquecuentaestadopuedenjuegoscontraest" (Indicator: "aes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found string "alatinafuerzaestiloguerraentrar" (Indicator: "aes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found string "deutscheuropeueuskaragaeilgesvenskaespa" (Indicator: "aes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found string "digoportadaespaciofamiliaantoniopermiteguardaralgunaspreciosalguiensentidovisitast" (Indicator: "aes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found string "ltimaestamosoficialtambienning" (Indicator: "aes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found string "ncompletaestudiosp" (Indicator: "aes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found string "aescribirmedicinalicenciaconsultaaspectoscr" (Indicator: "aes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found string "aespecialesdisponibleactualidadreferenciavalladolidbibliotecarelacionescalendariopol" (Indicator: "aes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000001.133721.93A90000.00000004.mdmp, 00000000-00006140.00000001.133721.93E20000.00000004.mdmp, 00000000-00006140.00000001.133721.FA6F0000.00000004.mdmp") Found string "aesenc" (Indicator: "aes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found string "aesdeclast" (Indicator: "aes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found string "aesdec" (Indicator: "aes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found string "aeskeygenassist" (Indicator: "aes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found string "aesimc" (Indicator: "aes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found string "aesenclast" (Indicator: "aes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found string "NYI: Implement AES intrinsic code generation" (Indicator: "aes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found string "ystem.IO.Compression.ZipFile.dll" (Indicator: "zipfile"; Source: "00000000-00006140.00000000.132809.F8BA0000.00000004.mdmp, 00000000-00006140.00000001.133721.F8BA0000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00006140.00000000.132809.FA6D0000.00000004.mdmp, 00000000-00006140.00000001.133721.93E20000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00006140.00000000.132809.FA6D0000.00000004.mdmp, 00000000-00006140.00000001.133721.93E20000.00000004.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00006140.00000000.132809.FA6D0000.00000004.mdmp, 00000000-00006140.00000001.133721.93A90000.00000004.mdmp, 00000000-00006140.00000001.133721.93E20000.00000004.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00006140.00000000.132809.FA6D0000.00000004.mdmp, 00000000-00006140.00000001.133721.93A90000.00000004.mdmp, 00000000-00006140.00000001.133721.93E20000.00000004.mdmp") Found string "Base64" (Indicator: "base64"; Source: "00000000-00006140.00000001.133721.8FC20000.00000004.mdmp, 00000000-00006140.00000001.133721.FA6F0000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006140.00000001.133721.93A90000.00000004.mdmp, 00000000-00006140.00000001.133721.93E20000.00000004.mdmp") Found string "Base64FormattingOptions" (Indicator: "base64"; Source: "00000000-00006140.00000001.133721.93A90000.00000004.mdmp, 00000000-00006140.00000001.133721.FA6F0000.00000004.mdmp")4d:T8da,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp")4e:T14eb,Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "Failed to map file. GetFileSizeEx(%s) failed with error %d" (Indicator: "GetFileSize"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "Failed to map file. GetFileSizeEx(%s) failed with error %d" (Indicator: "GetFileSize"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp, 00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "g____PInvoke|3_0" (Indicator: "ReadDirectoryChange"; Source: "00000000-00006140.00000000.132809.90A90000.00000004.mdmp") Found reference to API "ReadDirectoryChangesW" (Indicator: "ReadDirectoryChange"; Source: "00000000-00006140.00000000.132809.90A90000.00000004.mdmp") Found reference to API "ReadDirectoryChangesCallback" (Indicator: "ReadDirectoryChange"; Source: "00000000-00006140.00000000.132809.90A90000.00000004.mdmp") Found reference to API "ReadDirectoryChangesWT" (Indicator: "ReadDirectoryChange"; Source: "00000000-00006140.00000000.132809.90A90000.00000004.mdmp") Found reference to API "g____PInvoke|2_0" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API "g____PInvoke|3_0" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API "g____PInvoke|3_0" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeEx" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeEx" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API "GetFileVersionInfoEx" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API "GetFileVersionInfoExWTU" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeExWTU" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeExWTU" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006140.00000000.132809.91D40000.00000004.mdmp, 00000000-00006140.00000001.133721.91B21000.00000020.mdmp")4f:T810,Found registry deletion API: "g____PInvoke|3_0" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry deletion API: "g____PInvoke|4_0" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry deletion API: "g____PInvoke|5_0" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry deletion API: "RegDeleteTreeW" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry deletion API: "RegDeleteTree" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry deletion API: "RegDeleteValue" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyEx" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyExWTU" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry deletion API: "RegDeleteTreeWTU" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp" Found registry deletion API: "RegDeleteValueWTU" in "00000000-00006140.00000000.132809.93D11000.00000020.mdmp, 00000000-00006140.00000000.132809.93D30000.00000004.mdmp"50:Tb2c,Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "SetKernelObjectSecurity" (Indicator: "SetKernelObjectSecurity"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "System.Runtime.CompilerServices.IgnoresAccessChecksToAttribute" (Indicator: "AccessCheck"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "IgnoresAccessChecksToAttribute" (Indicator: "AccessCheck"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "SetKernelObjectSecurity" (Indicator: "SetKernelObjectSecurity"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "ystem.Runtime.CompilerServices.IgnoresAccessChecksToAttribute" (Indicator: "AccessCheck"; Source: "00000000-00006140.00000000.132809.91BF1000.00000020.mdmp") Found reference to API "EmitIgnoresAccessChecksToAttribute" (Indicator: "AccessCheck"; Source: "00000000-00006140.00000000.132809.91BF1000.00000020.mdmp") Found reference to API "GetIgnoresAccessChecksToAttributeConstructor" (Indicator: "AccessCheck"; Source: "00000000-00006140.00000000.132809.91BF1000.00000020.mdmp")51:T402,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp") Found reference to API "SafeExitProcess: exitCode = %d sca = %d" (Indicator: "ExitProcess"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "In EEPolicy::HandleExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006140.00000000.132809.04120000.00000002.mdmp")52:Tcbe,"k__BackingField\" (Source: \"00000000-00006140.00000001.133721.91C50000.00000004.mdmp\")\n Found string \"set_MachineName\" (Source: \"00000000-00006140.00000001.133721.91C50000.00000004.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00006140.00000001.133721.91CB1000.00000020.mdmp, 00000000-00006140.00000001.133721.93E20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"699cd19744fa1fe41e0a631c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006140-00000C2C-1043204804\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"699cd19744fa1fe41e0a631c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006140.00000000.132809.04120000.00000002.mdmp\")\n Found string \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006140.00000000.132809.FA6D0000.00000004.mdmp\")\n Found string \"GetCursorPosition\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00006140.00000001.133721.91CB1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"699cd19744fa1fe41e0a631c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"699cd19744fa1fe41e0a631c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"699cd19744fa1fe41e0a631c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00006140.00000000.132809.04120000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00006140.00000000.132809.04120000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"699cd19744fa1fe41e0a631c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoExCancel\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006792-00000C2C-1061666527\")\n Found reference to API \"GetAddrInfoExW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006792-00000C2C-1061667263\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"699cd19744fa1fe41e0a631c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"cf85a4816715b8fa6c1eb5b50d1c70cfef116522742f6f1c77cb8689166b9f40.bin\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00003552.00000001.133705.7B3AB000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00006140.00000000.132809.04120000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00006140.00000000.132809.04120000.00000002.mdmp\"\n Found system information discovery API: \"GetMonitorInfo\" in \"00000000-00006140.00000000.132809.FA6D0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"699cd19744fa1fe41e0a631c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"