26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 49:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ab,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.MSILMamut Sample bbf00e5d04d2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bbf00e5d04d2…. Malware family: IL:Trojan.MSILMamut. Threat score 100/100. 11/28 AV engines flagged this file. 11 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bbf00e5d04d29ebf5fc920b7bc238170a714f3b8d0de3054550fb146468a16e6","keywords":["Malicious","IL:Trojan.MSILMamut","malware analysis","sandbox report","threat intelligence","bbf00e5d04d29ebf5fc920b7bc238170a714f3b8d0de3054550fb146468a16e6"],"about":{"@type":"SoftwareApplication","name":"defounderzx.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"bbf00e5d04d29ebf5fc920b7bc238170a714f3b8d0de3054550fb146468a16e6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"IL:Trojan.MSILMamut","antivirusDetections":{"malicious":11,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9ea,"defounderzx.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000a200a80100000000000000000000000000000000000013009d00a80100000000000000000000e86a34000000000020000000000000000000000060483600d8673400f868340068973600a06c340000000000a4f555000000000000f8550095e1f7766c20f701feffffffff2bfb769a2afb7664c5cd76b69ffb76000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000064c5cd766897360064c5cd76 (UID: 00000000-00001292) "defounderzx.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001292) "defounderzx.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001292) "defounderzx.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000340000000000642b340000000000bd04000000000000b82a34005104000070f4370000000000d10400001800010180000000d327796c00f1160095e1f776742ef701000000000500000500ad37006f21004e70f437000100000000000000ff07000068f437006f21004e70f437000100000000000000020000000c000000e8c93700e8c93700e3c9370000000000acf016000000340070f43701f0ef1600b8f0160010f6160095e1f776542ef701feffffff435cfb765059fb7694000000a0000000e2c93700e0c937009400000094f11600fdfe4875b00000003cf1160040f11600 (UID: 00000000-00001292)28:T2386,"defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f0ab360014f85500145cfb76435cfb76e0f8550001000000940134000100000094f75500935cfc7640830377d4a0fb76e8cb5977e0f85500010000000100000058bf36000000000064f7550094f7550000f8550095e1f7768438f701feffffffd4a0fb761bbe0a750000c87600000000 (UID: 00000000-00001292) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031002c2c4973576f77363450726f636573732c6b65726e656c33322e646c6c2c223235323a30323a34362e323839222c52583d302c50583d3000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001292) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f6fb7648d41a77f42e6a7158d03600a0356a7178d41a775ce8160080bd3600b2f4fb7668d41a776ce81600000063710000637100000000c8e71600f0000000f000637100000000d8e71600530000006ce9160000000000010000003ce8160040f5fb76000000000000000028e81600 (UID: 00000000-00001292) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c478f7350c33d008c478f730000000050c33d0054d41600086dfb76188103770000000008d5160000000000de54e76494d4160095e1f776bc2df701feffffff6b2cfc7631190b7502100000000000000000010068d41600c89ffb768c478f730000000000000000 (UID: 00000000-00001292) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001292) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000a0bc310078f86f00145cfb76435cfb7644f96f000100000094012f0001000000f8f76f00935cfc7640830377d4a0fb761bbd637744f96f00010000000100000020bf310000000000c8f76f00f8f76f0064f86f0095e1f7761b4ef701feffffffd4a0fb761bbe0a750000c87600000000 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031002c2c4973576f77363450726f636573732c6b65726e656c33322e646c6c2c223235323a30323a34392e373231222c52583d302c50583d3000300072616c2c205075626c69634b6579546f6b656e3d623033663566376631316435306133612220616c6c6f77446566696e6974696f6e3d22 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031003e78f68804b29c787534375e68000000000100000000000000010000009cf68804000000002812f401d8f6880480963a00a8f688048f9c787534375e6802000000000000001800000001000000acf688042823b96a00002f00000000000c0000006022fc01b8f688042f995e680c000000 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f2449e76bc768875b0f2390018d03600b4f23900b0f2390030000000000000003cf0200050dca276b0f239003000000000000000fc5f900430000000020000000000000018000000ebc7351c64f020002823b96a00002f00000000000c00000028c79f6d70f020002f995e680c000000 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000010f120006a6fe76400000000bc6fe764b36f113a8cec20000000000090f2200015de11778f5a224dfeffffff7f671977e2d887752824e96c02000000000000001800000030a55e68d0f020002823b96a00002f00000000000c00000030a55e68dcf020002f995e680c000000 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310004a386af6a505e3b000000000000f5e1049823af6a505e3b0048f5e104e722ae6a505e3b0020000000000000003c37ae6a2812f4012082fc012812f401020000000000000018000000005e3b004cf5e1042823b96a00002f00000000000c0000002082fc0158f5e1042f995e680c000000 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f2449e76bc768875e0f4390018d03600e4f43900e0f4390030000000000000003cf0200050dca276e0f439003000000000000000ec65900430000000020000000000000018000000ebc7351c64f020002823b96a00002f00000000000c00000028c79f6d70f020002f995e680c000000 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000001000000e8f020006a6fe76400000000bc6fe7645b6f113a64ec20000000000090f2200015de11778f5a224dfeffffff7f671977e2d887752824e96c02000000000000001800000030a55e68a8f020002823b96a00002f00000000000c00000030a55e68b4f020002f995e680c000000 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310005a386af6a00633b0000000000e0f408059823af6a00633b0028f50805e722ae6a00633b0020000000000000003c37ae6a2812f40120c2fc012812f40102000000000000001800000000633b002cf508052823b96a00002f00000000000c00000020c2fc0138f508052f995e680c000000 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f2449e76bc7688753080370018d036003480370030803700800000000000000018f0200050dca276308037005000000000000000acec900450000000020000000000000018000000cfc7351c40f020002823b96a00002f00000000000c00000028c79f6d4cf020002f995e680c000000 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310005a386af6a785e3b0000000000d0f338059823af6a785e3b0018f43805e722ae6a785e3b0020000000000000003c37ae6a2812f401a4a7fb012812f401020000000000000018000000005e3b001cf438052823b96a00002f00000000000c000000a4a7fb0128f438052f995e680c000000 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310075285e3b0018d0360000000000285e3b002000000000000000e4ee200050dca276285e3b0010000000bc8037000c6690041000000010ef2000a6ec9f6d02000000000000001800000028c79f6d14ef20002823b96a00002f00000000000c00000028c79f6d20ef20002f995e680c000000 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000008f020006a6fe76400000000bc6fe764bb70113a84eb20000000000090f2200015de11778f5a224dfeffffff7f671977e2d887752824e96c02000000000000001800000030a55e68c8ef20002823b96a00002f00000000000c00000030a55e68d4ef20002f995e680c000000 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000018f020006a6fe76400000000bc6fe7648b70113a94eb20000000000090f2200015de11778f5a224dfeffffff7f671977e2d887752824e96c02000000000000001800000030a55e68d8ef20002823b96a00002f00000000000c00000030a55e68e4ef20002f995e680c000000 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310005a386af6ae0303d000000000000ef4f059823af6ae0303d0048ef4f05e722ae6ae0303d0020000000000000003c37ae6a2812f401a4c7fb012812f40102000000000000001800000000303d004cef4f052823b96a00002f00000000000c000000a4c7fb0158ef4f052f995e680c000000 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310075005e3b0018d0360000000000005e3b0020000000000000002cef200050dca276005e3b0010000000443c3c003cee90041000000058ef2000a6ec9f6d02000000000000001800000028c79f6d5cef20002823b96a00002f00000000000c00000028c79f6d68ef20002f995e680c000000 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000010000002cf020006a6fe76400000000bc6fe7649770113aa8eb20000000000090f2200015de11778f5a224dfeffffff7f671977e2d887752824e96c02000000000000001800000030a55e68ecef20002823b96a00002f00000000000c00000030a55e68f8ef20002f995e680c000000 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f6fb76bfa62c77f42e6a7170133e00a0356a71cfa62c7784ec200018bc3100b2f4fb76dfa62c7794ec2000000063710000637100000000f0eb2000f0000000f00063710000000000ec20005300000094ed2000000000000100000064ec200040f5fb76000000000000000050ec2000 (UID: 00000000-00003208) "defounderzx.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310006a386af6ad819280500000000a0ef05069823af6ad8192805e8ef0506e722ae6ad819280520000000000000003c37ae6a2812f401009c00022812f40102000000000000001800000000192805ecef05062823b96a00002f00000000000c000000009c0002f8ef05062f995e680c000000 (UID: 00000000-00003208)29:Ta4e,"defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")2a:Ta1c,"defounderzx.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "defounderzx.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "defounderzx.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "defounderzx.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "defounderzx.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "defounderzx.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "defounderzx.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "defounderzx.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "defounderzx.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "defounderzx.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "defounderzx.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "defounderzx.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "defounderzx.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "defounderzx.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "defounderzx.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "defounderzx.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "defounderzx.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "defounderzx.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "defounderzx.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "defounderzx.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "defounderzx.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "defounderzx.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "defounderzx.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "defounderzx.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "defounderzx.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")2b:T51e,"defounderzx.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "defounderzx.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\02FAF3E291435468607857694DF5E45B68851868"; Key: "BLOB") "defounderzx.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\039EEDB80BE7A03C6953893B20D2D9323A4C2AFD"; Key: "BLOB") "defounderzx.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "defounderzx.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\07E032E020B72C3F192F0628A2593A19A70F069E"; Key: "BLOB") "defounderzx.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\2796BAE63F1801E277261BA0D77770028F20EEE4"; Key: "BLOB") "defounderzx.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\323C118E1BF7B8B65254E2E2100DD6029037F096"; Key: "BLOB") "defounderzx.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\3679CA35668772304D30A5FB873B0FA77BB70D54"; Key: "BLOB") "defounderzx.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F"; Key: "BLOB")2c:T4743,"defounderzx.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001292) "defounderzx.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter C:\vaultcli.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\93d03eb9812405fa70e89d4efd5f7e14\System.Security.ni.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003208) "defounderzx.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003208)2d:T12bd9,"defounderzx.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmWINNLSEnableIME (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmWINNLSGetEnableStatus (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExA (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEA (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEA (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEA (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmEscapeA (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmEscapeW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetCompositionWindow (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmRegisterClient (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontA (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontA (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmLockIMC (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmUnlockIMC (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmLoadIME (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmFreeLayout (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmActivateLayout (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetCandidateWindow (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmConfigureIMEW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetStatusWindowPos (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetImeInfoEx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmLockImeDpi (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmUnlockImeDpi (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetOpenStatus (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetActiveContext (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmTranslateMessage (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmLoadLayout (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmProcessKey (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmPutImeMenuItemsIntoMappedFile (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetProperty (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmEnumInputContext (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSystemHandler (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CtfImmTIMActivate (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CtfImmRestoreToolbarWnd (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CtfImmHideToolbarWnd (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CtfImmDispatchDefImeMessage (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CtfImmNotify (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CtfImmSetDefaultRemoteKeyboardLayout (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CtfImmGetCompatibleKeyboardLayout (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GdipBitmapGetPixel (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GdipBitmapSetPixel (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001292) "defounderzx.exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmWINNLSEnableIME (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmWINNLSGetEnableStatus (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmEscapeA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmEscapeW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetCompositionWindow (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmRegisterClient (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmLockIMC (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmUnlockIMC (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmLoadIME (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmFreeLayout (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmActivateLayout (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetCandidateWindow (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmConfigureIMEW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetStatusWindowPos (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetImeInfoEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmLockImeDpi (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmUnlockImeDpi (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetOpenStatus (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetActiveContext (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmTranslateMessage (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmLoadLayout (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmProcessKey (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmPutImeMenuItemsIntoMappedFile (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmGetProperty (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmEnumInputContext (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmSystemHandler (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CtfImmTIMActivate (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CtfImmRestoreToolbarWnd (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CtfImmHideToolbarWnd (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CtfImmDispatchDefImeMessage (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CtfImmNotify (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CtfImmSetDefaultRemoteKeyboardLayout (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CtfImmGetCompatibleKeyboardLayout (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter TerminateProcessW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter VaultEnumerateVaults (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter VaultOpenVault (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter VaultEnumerateItems (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusExW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter TraceRegisterExA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter TracePrintfExA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter OpenSCManagerA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SslLookupCipherLengths (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetSignatureInterface (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SetClipboardViewer (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter OleGetClipboard (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SendMessageA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SetWindowsHookEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SetWindowsHookExA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter CallNextHookEx (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetKeyboardState (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00003208) "defounderzx.exe" called "GetProcAddress" with a parameter ToUnicodeEx (UID: 00000000-00003208)2e:Tc23,Found reference to API (Indicator: "GetModuleHandle"; File: "defounderzx.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "defounderzx.exe") Found reference to API (Indicator: "GetObject"; File: "defounderzx.exe") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "defounderzx.exe") Found reference to API (Indicator: "SetWindowsHookEx"; File: "defounderzx.exe") Found reference to API (Indicator: "CallNextHookEx"; File: "defounderzx.exe") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00001292.00000000.66442.01292000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001292.00000000.66442.01292000.00000020.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00001292.00000000.66442.01292000.00000020.mdmp, 00000000-00001292.00000000.66459.00470000.00000004.mdmp, 00000000-00001292.00000000.66459.045D0000.00000004.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00001292.00000000.66442.01292000.00000020.mdmp") Found reference to API (Indicator: "SetWindowsHookEx"; Source: "00000000-00001292.00000000.66442.01292000.00000020.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00001292.00000000.66442.01292000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001292.00000000.66459.00470000.00000004.mdmp, 00000000-00001292.00000000.66459.045D0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001292.00000000.66459.045D0000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001292.00000000.66459.045D0000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00001292.00000000.66459.045D0000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00001292.00000000.66459.045D0000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00001292.00000000.66459.045D0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00003208.00000000.66666.01292000.00000020.mdmp, 00000000-00003208.00000003.75815.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003208.00000000.66666.01292000.00000020.mdmp, 00000000-00003208.00000003.75815.00400000.00000040.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00003208.00000000.66666.01292000.00000020.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00003208.00000000.66666.01292000.00000020.mdmp, 00000000-00003208.00000003.75815.00400000.00000040.mdmp") Found reference to API (Indicator: "SetWindowsHookEx"; Source: "00000000-00003208.00000000.66666.01292000.00000020.mdmp, 00000000-00003208.00000003.75815.00400000.00000040.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00003208.00000000.66666.01292000.00000020.mdmp, 00000000-00003208.00000003.75815.00400000.00000040.mdmp")2f:T35d4,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001292.00000000.66459.00340000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001292.00000000.66459.00340000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003208.00000000.66666.002D0000.00000004.mdmp 00000000-00003208.00000001.68589.002D0000.00000004.mdmp 00000000-00003208.00000002.70509.002D0000.00000004.mdmp 00000000-00003208.00000003.75815.002D0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00003208.00000000.66666.002D0000.00000004.mdmp 00000000-00003208.00000001.68589.002D0000.00000004.mdmp 00000000-00003208.00000002.70509.002D0000.00000004.mdmp 00000000-00003208.00000003.75815.002D0000.00000004.mdmp "|SYSTEM\CurrentControlSet\Services\Tcp" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp "|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Hostname" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp "32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ForwardBufferMem" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Cl" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Paramete;U" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|System\CurrentControlSet\ServXU" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IPFilterU" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DatabasePath" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp "2Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableDeadGWDetect" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Para3" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTOS" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTTL" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|EnableDHCP" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\S" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|LeaseObtainedTime" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|DhcpServer" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|SearchList" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableDNS" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Hostname" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IGMPLevel" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters\Tcpip|IPAddress" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters\Tcpip" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|RawIPAllowedProtocols" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TCPAllowedPorts" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|UDPAllowedPorts" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|UseZeroBroadcast" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|PktType" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameter]" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Paramete|" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|VirtualNetworkNumber" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|KeepAliveInterval" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.002F0000.00000004.mdmp 00000000-00003208.00000002.70509.002F0000.00000004.mdmp 00000000-00003208.00000003.75815.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|SearchLis" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Domain" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp "ry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NameServer" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.04C80000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.048E0000.00000004.mdmp 00000000-00003208.00000001.68589.048E0000.00000004.mdmp 00000000-00003208.00000001.68589.04C80000.00000004.mdmp 00000000-00003208.00000002.70509.048E0000.00000004.mdmp 00000000-00003208.00000002.70509.04C80000.00000004.mdmp 00000000-00003208.00000002.70509.06510000.00000004.mdmp 00000000-00003208.00000003.75815.048E0000.00000004.mdmp 00000000-00003208.00000003.75815.04C80000.00000004.mdmp 00000000-00003208.00000003.75815.06510000.00000004.mdmp 00000000-00003208.00000003.75815.06710000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityContrp/" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00003208.00000000.66666.002F0000.00000004.mdmp 00000000-00003208.00000000.66666.048E0000.00000004.mdmp 00000000-00003208.00000001.68589.048E0000.00000004.mdmp 00000000-00003208.00000001.68589.04C80000.00000004.mdmp 00000000-00003208.00000001.68589.05240000.00000004.mdmp 00000000-00003208.00000002.70509.048E0000.00000004.mdmp 00000000-00003208.00000002.70509.04C80000.00000004.mdmp 00000000-00003208.00000002.70509.05240000.00000004.mdmp 00000000-00003208.00000002.70509.06510000.00000004.mdmp 00000000-00003208.00000003.75815.048E0000.00000004.mdmp 00000000-00003208.00000003.75815.04C80000.00000004.mdmp 00000000-00003208.00000003.75815.05240000.00000004.mdmp 00000000-00003208.00000003.75815.06510000.00000004.mdmp 00000000-00003208.00000003.75815.06710000.00000004.mdmp30:Td7d,"defounderzx.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "C:\vaultcli.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "defounderzx.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135]31:T1c65,"eSet-Cookie: __cfruid=e0dc987e5a80865cd2448257ce5a474b2de79125-1699267679; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=Tu0dYf4BTU8V.vbaIPqLpDiVHwhhrl89uJ8KUKjL36w-1699267679557-0-604800000; path=/; domain=.discordapp." (Indicator: "discordapp.com") "=NoneSet-Cookie: __cfruid=6b02422cdee157e06978431299f9b84c3beb650e-1699267681; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=kaXI6F7NT07Z5XkAhaiZkTmoo5X90WsKW7sQ86ic8DE-1699267681649-0-604800000; path=/; domain=.discord" (Indicator: "discordapp.com") "ookie: __cfruid=d0bfaa73875b649c420306dc4d3b82aa449d0ccb-1699267683; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=vBAi4gxFI5Cf7JpbP1P6G.ccWYJsgzkAE7nJHVSnPz0-1699267683207-0-604800000; path=/; domain=.discordapp.com; Htt" (Indicator: "discordapp.com") "oneSet-Cookie: __cfruid=dcaa1a21fae3ac7c0ff574df55367822325f6b29-1699267684; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=zINTqu4KLSAS7sOrRS88NF5lTuLUosPUQCwzRfL4m1E-1699267684652-0-604800000; path=/; domain=.discordap" (Indicator: "discordapp.com") "oneSet-Cookie: __cfruid=9e65271d7bbc34f783cd31344124f66e9d52e742-1699267709; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=ctivKmZgUY389Zf2qUXFQ2XfbRw5y3G6AVUsHrsBu6U-1699267709303-0-604800000; path=/; domain=.discordap" (Indicator: "discordapp.com") "et-Cookie: __cfruid=9815a3f705026192cffc18d4b21121dd2786ee66-1699267710; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=NnYL29jJ14IS8RRbN3ch2JGfgwb3VsbxArS.boDkJ9c-1699267710595-0-604800000; path=/; domain=.discordapp.com;" (Indicator: "discordapp.com") "eSet-Cookie: __cfruid=746333fafebb6c452e2dd514004cc476978f07cc-1699267711; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=R74GV8wXJTF_xaZXx2SMWkpR2ZmdqarxFGNPMHscoLI-1699267711915-0-604800000; path=/; domain=.discordapp." (Indicator: "discordapp.com") "Set-Cookie: __cfruid=7f5cb90eb88308a084b94025aa780a44859dcc57-1699267713; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=yZLDU1T5_RlDVPM9ozoLmLKowz4UNhnvG6oadGL2tFM-1699267713255-0-604800000; path=/; domain=.discordapp.co" (Indicator: "discordapp.com") "Set-Cookie: __cfruid=0c6ff949959ee0facbc6892f967c9b025f9c9911-1699267714; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=BY37EA6DONcZwnO0ThwgG111bg0eMjQTQEEDtPsq3aY-1699267714601-0-604800000; path=/; domain=.discordapp.co" (Indicator: "discordapp.com") "et-Cookie: __cfruid=60d0fcee7669284dabf648d62239b80a96ffd635-1699267739; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=H_agQEtKgAgRo_oEdiQkgM0AsyJx2bBCyT1uhphhNA0-1699267739440-0-604800000; path=/; domain=.discordapp.com;" (Indicator: "discordapp.com") "et-Cookie: __cfruid=47d3bc121d1cca7787f083d27ba5c78689b8bdd7-1699267740; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=x2LgrgxY2bR.U7dYf.pwCA0lSfypeWeYoCIPDASf2nE-1699267740786-0-604800000; path=/; domain=.discordapp.com;" (Indicator: "discordapp.com") "et-Cookie: __cfruid=03965f7e50ffab7a5eeca22a00b5f8b8f83d8b23-1699267742; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=uDim4k9mVOWl8FdX1mtApZF79J5_6sTbeg8OrXv94fY-1699267742088-0-604800000; path=/; domain=.discordapp.com;" (Indicator: "discordapp.com") "Set-Cookie: __cfruid=af09f0b724800f5a4fc186895b5c4f6ef88c80e9-1699267743; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=4FEGiDDFimiMjYVw7RpezvGtan6gzy1l6S4FLyysLtE-1699267743472-0-604800000; path=/; domain=.discordapp.co" (Indicator: "discordapp.com") "eSet-Cookie: __cfruid=2835a0603dd4d424f36a382240eff91d2bea7620-1699267744; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=h8XWgsSN94HUPlumwLlBJgFVzcq49eYoGHdAhMy4VZQ-1699267744844-0-604800000; path=/; domain=.discordapp." (Indicator: "discordapp.com") "te=NoneSet-Cookie: __cfruid=8d89738d77d6f4e95a7cf6db91a205cfc489b6c1-1699267746; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=s_5gFwE.o7m0vSYQzN_.._VXYmFcG7xW.zCefmrKH0o-1699267746179-0-604800000; path=/; domain=.disco" (Indicator: "discordapp.com") "Set-Cookie: __cfruid=6e5d437362df920a77762dc8308fabbe70a7db2d-1699267747; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=FXzA0Cak9YHZVf.7r1ocNQjgcByTZFfZ0llrfPNBlIk-1699267747519-0-604800000; path=/; domain=.discordapp.co" (Indicator: "discordapp.com") "Set-Cookie: __cfruid=e8443ef9a7fe3381f890ffc0e9f2faaceed00765-1699267748; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=rfbxYZZ7T8iKnv41.XmI6gZrelbnhZkeKjikzLHqRpA-1699267748933-0-604800000; path=/; domain=.discordapp.co" (Indicator: "discordapp.com") "et-Cookie: __cfruid=a7db464aaad6c195e820f93a3e773b6a6db5159c-1699267769; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=Gfy6itF2xJugiigBzcfNSid4iqk2HPRY9EByy0t3G2M-1699267769563-0-604800000; path=/; domain=.discordapp.com;" (Indicator: "discordapp.com") "eSet-Cookie: __cfruid=03e8378f116e6a99eff8f0474ebe3092c641cadb-1699267770; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=v9094Dqbm5sUsrE65I578Ng3P9YkDGGUm8uZwkYpFSs-1699267770959-0-604800000; path=/; domain=.discordapp." (Indicator: "discordapp.com") "oneSet-Cookie: __cfruid=4234eb3fdd6ef460c8e00017b3822fd5231158dc-1699267772; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=hIVQuFVp5zVX0wcxVXXCn5uLKbNI.wgaKq2curVa4TY-1699267772451-0-604800000; path=/; domain=.discordap" (Indicator: "discordapp.com") "eSet-Cookie: __cfruid=7ab8ca9f4a6321b95a19420e3441c4c1dab21691-1699267773; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=G7O9I3GpbvodtTwXPz6FiUfIo24TP6LzqjCDwpVx1AQ-1699267773863-0-604800000; path=/; domain=.discordapp." (Indicator: "discordapp.com") "-Cookie: __cfruid=0e52b635efbeae92dea91d269ed2bf8289bf4b17-1699267775; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=cuKBrB2vCdpYbIlE0Qg8DTBMtH1_xpOg7iR5KvqlKrQ-1699267775264-0-604800000; path=/; domain=.discordapp.com; H" (Indicator: "discordapp.com") "et-Cookie: __cfruid=4b747dcf3d866cd24fd09c1d77f399a579944be0-1699267799; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=pCyGRp9ly5i0VDoGMljhrsI.Kl.rNCBsNsYRVo.C4nA-1699267799743-0-604800000; path=/; domain=.discordapp.com;" (Indicator: "discordapp.com") "oneSet-Cookie: __cfruid=ef4ff93cdb66ef1079484024e9db53084a2444f0-1699267801; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=k.AWh1YgBJblINhtkSQF7tVzfbaMSL1BP_dISMym4qI-1699267801162-0-604800000; path=/; domain=.discordap" (Indicator: "discordapp.com") "te=NoneSet-Cookie: __cfruid=03649ece0bd0fbc0dceb9dc27cf171df1c86005a-1699267802; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=8bogFBp5pBIIvHhm3HqY0u8adPyPpcLXjG0jf9Nh2GQ-1699267802848-0-604800000; path=/; domain=.disco" (Indicator: "discordapp.com")32:T2833,"defounderzx.exe" loaded module "GDI32.DLL" at base 753f0000 "defounderzx.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 770b0000 "defounderzx.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70410000 "defounderzx.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "defounderzx.exe" loaded module "KERNEL32" at base 75440000 "defounderzx.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "defounderzx.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6aae0000 "defounderzx.exe" loaded module "ADVAPI32.DLL" at base 75200000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 71b70000 "defounderzx.exe" loaded module "SHLWAPI.DLL" at base 76980000 "defounderzx.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "defounderzx.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "defounderzx.exe" loaded module "VERSION.DLL" at base 74300000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64d80000 "defounderzx.exe" loaded module "USER32.DLL" at base 752c0000 "defounderzx.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "defounderzx.exe" loaded module "MSCOREE.DLL" at base 71c00000 "defounderzx.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "defounderzx.exe" loaded module "PSAPI.DLL" at base 751f0000 "defounderzx.exe" loaded module "KERNEL32.DLL" at base 75440000 "defounderzx.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63970000 "defounderzx.exe" loaded module "RPCRT4.DLL" at base 77100000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "defounderzx.exe" loaded module "OLE32.DLL" at base 75740000 "defounderzx.exe" loaded module "CRYPTBASE.DLL" at base 74d60000 "defounderzx.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c10000 "defounderzx.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 70b50000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 687b0000 "defounderzx.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62f10000 "defounderzx.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 62d60000 "defounderzx.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61ef0000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "defounderzx.exe" loaded module "UXTHEME.DLL" at base 73c10000 "defounderzx.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 616d0000 "defounderzx.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 686a0000 "defounderzx.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60f50000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6d960000 "defounderzx.exe" loaded module "NTDLL.DLL" at base 76f60000 "defounderzx.exe" loaded module "SHELL32.DLL" at base 75a00000 "defounderzx.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 770d0000 "defounderzx.exe" loaded module "PROFAPI.DLL" at base 74e80000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "defounderzx.exe" loaded module "BCRYPT.DLL" at base 74980000 "defounderzx.exe" loaded module "CRYPTSP.DLL" at base 74870000 "defounderzx.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74600000 "defounderzx.exe" loaded module "IMM32.DLL" at base 770b0000 "defounderzx.exe" loaded module "COMCTL32.DLL" at base 71630000 "defounderzx.exe" loaded module "AMSI.DLL" at base 0 "defounderzx.exe" loaded module "GDIPLUS.DLL" at base 73780000 "defounderzx.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73780000 "defounderzx.exe" loaded module "WINDOWSCODECS.DLL" at base 73280000 "defounderzx.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 60d60000 "defounderzx.exe" loaded module "NTDLL" at base 76f60000 "defounderzx.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d10000 "defounderzx.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 770d0000 "defounderzx.exe" loaded module "RPCRTREMOTE.DLL" at base 74e00000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "defounderzx.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 60c30000 "defounderzx.exe" loaded module "CLBCATQ.DLL" at base 75970000 "defounderzx.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75440000 "defounderzx.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6cb70000 "defounderzx.exe" loaded module "OLEAUT32.DLL" at base 769e0000 "defounderzx.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6d6d0000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 685e0000 "defounderzx.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6ce90000 "defounderzx.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6d9e0000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "defounderzx.exe" loaded module "SSPICLI.DLL" at base 74cf0000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "defounderzx.exe" loaded module "C:\VAULTCLI.DLL" at base 0 "defounderzx.exe" loaded module "VAULTCLI.DLL" at base 6d950000 "defounderzx.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.SECURITY\93D03EB9812405FA70E89D4EFD5F7E14\SYSTEM.SECURITY.NI.DLL" at base 60e70000 "defounderzx.exe" loaded module "OLEAUT32" at base 769e0000 "defounderzx.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 60a40000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "defounderzx.exe" loaded module "RASAPI32.DLL" at base 71e30000 "defounderzx.exe" loaded module "RTUTILS.DLL" at base 72c70000 "defounderzx.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 770d0000 "defounderzx.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 770d0000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "defounderzx.exe" loaded module "WS2_32.DLL" at base 751a0000 "defounderzx.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74830000 "defounderzx.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74390000 "defounderzx.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74820000 "defounderzx.exe" loaded module "RASMAN.DLL" at base 71e10000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "defounderzx.exe" loaded module "WINHTTP.DLL" at base 70a90000 "defounderzx.exe" loaded module "CREDSSP.DLL" at base 74500000 "defounderzx.exe" loaded module "IPHLPAPI.DLL" at base 731b0000 "defounderzx.exe" loaded module "DHCPCSVC6.DLL" at base 73080000 "defounderzx.exe" loaded module "DHCPCSVC.DLL" at base 73000000 "defounderzx.exe" loaded module "NSI.DLL" at base 752b0000 "defounderzx.exe" loaded module "CFGMGR32.DLL" at base 74ec0000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "defounderzx.exe" loaded module "DNSAPI.DLL" at base 746f0000 "defounderzx.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 770d0000 "defounderzx.exe" loaded module "RASADHLP.DLL" at base 715b0000 "defounderzx.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73120000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "defounderzx.exe" loaded module "SECUR32.DLL" at base 74b90000 "defounderzx.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74670000 "defounderzx.exe" loaded module "NCRYPT.DLL" at base 749a0000 "defounderzx.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74540000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "defounderzx.exe" loaded module "CRYPT32.DLL" at base 74f30000 "defounderzx.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "defounderzx.exe" loaded module "USERENV.DLL" at base 750f0000 "defounderzx.exe" loaded module "GPAPI.DLL" at base 74440000 "defounderzx.exe" loaded module "DWMAPI.DLL" at base 73920000 "defounderzx.exe" loaded module "USER32" at base 752c000033:T48c,"defounderzx.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"34:T7a2,"defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "defounderzx.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HANS") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HANS") "defounderzx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN")35:Tfe7,Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00001292-00000C25-48536634] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001292-00000C25-48723419] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001292-00000C25-48797626] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001292-00000C25-48993290] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001292-00000C25-49027403] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001292-00000C25-49120229] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001292-00000C25-49148624] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00001292-00000C25-49175178] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001292-00000C25-49372837] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001292-00000C25-49507151] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00001292-00000C25-49526821] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00001292-00000C25-49557663] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00001292-00000C25-49618176] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001292-00000C25-49700395] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00001292-00000C25-49716309] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00001292-00000C25-50002020] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00001292-00000C25-50023458] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001292-00000C25-50149768] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001292-00000C25-50686291] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001292-00000C25-50696824] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00001292-00000C25-50708485] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00001292-00000C25-51137982] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00001292-00000C25-51436388] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003208-00000C25-53136665] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00003208-00000C25-53228527]36:T740,"defounderzx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "defounderzx.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "defounderzx.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "defounderzx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "defounderzx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") "defounderzx.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "defounderzx.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "defounderzx.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "defounderzx.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "defounderzx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "defounderzx.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "defounderzx.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "defounderzx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "defounderzx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") "defounderzx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") "defounderzx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "")37:Tb27,"defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "NOCLIENTCHECKS"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL"; Key: "RELEASE"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "DEFOUNDERZX"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "DISABLECONFIGCACHE"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4"; Value: "") "defounderzx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "763FD754-7086-4DFE-95EB-C01A46FAF4CA"; Value: "")38:T508,"defounderzx.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "defounderzx.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "defounderzx.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "defounderzx.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "defounderzx.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "defounderzx.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "defounderzx.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "defounderzx.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "defounderzx.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"39:T4cc,"defounderzx.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "defounderzx.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "defounderzx.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "defounderzx.exe" trying to touch file "C:\FLTLIB.DLL" "defounderzx.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "defounderzx.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "defounderzx.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "defounderzx.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "defounderzx.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "defounderzx.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "defounderzx.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "defounderzx.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "defounderzx.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" "defounderzx.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "defounderzx.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll"3a:T5a0,"defounderzx.exe" trying to access non-existent file "C:\FLTLIB.DLL" "defounderzx.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "defounderzx.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "defounderzx.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "defounderzx.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "defounderzx.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "defounderzx.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "defounderzx.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "defounderzx.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" "defounderzx.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" "defounderzx.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "defounderzx.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "defounderzx.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll"3b:T555,"defounderzx.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "defounderzx.exe" trying to access non-existent file "C:\defounderzx.exe.config" "defounderzx.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "defounderzx.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\pxALO\" "defounderzx.exe" trying to access non-existent file "C:\defounderzx.INI" "defounderzx.exe" trying to access non-existent file "C:\defounderzx.exe.Local\" "defounderzx.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\MSCOREE.DLL.LOCAL" "defounderzx.exe" trying to access non-existent file "\Device\HarddiskVolume2\DEFOUNDERZX.EXE.CONFIG" "defounderzx.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "defounderzx.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\PXALO" "defounderzx.exe" trying to access non-existent file "\Device\HarddiskVolume2\DEFOUNDERZX.INI" "defounderzx.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "defounderzx.exe" trying to access non-existent file "\Device\HarddiskVolume2\DEFOUNDERZX.EXE.LOCAL"3c:T763,Heuristic match: "RrE.SV" Heuristic match: ",N.er" Heuristic match: "GeF.zM" Heuristic match: "S9iqmgvw,czc0?1$0" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0zg\k:/" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5osalt" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynslk_\k9o_\k6" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!work1!0]pinternet1verisign," - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nsalt" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:nd" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entruscom1" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?$8\k88\k<8\k08\k48\k8\ki" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=enrz1.3.6.1.4.1.311.76.6.1eneo_wp" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00003208.00000001.68589.05240000.00000004.mdmp") Found URL "https://discordapp.com/api/webhooks/1164197415147020358/r6dhdedevlubs99_mqtr2eyavlqipvg1aa9kvn_oaprfigxgxydfabvojcra0w4bxburwinsta0\defaultallusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00003208.00000002.70509.002F0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0t0r071http://crl3.digicert.com/cloudflareinceccca-3.crl071http://crl4.digicert.com/cloudflareinceccca-3.crl0vj0h0$http://ocsp.digicert.com0@4http://cacerts.digicert.com/cloudflareinceccca-3.crt0qhyfq" - Source: "00000000-00003208.00000002.70509.002F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digicert.com/omniroot2025.crl0mf0d070*0(https://www.digicert.com/cps09m^kwd8zw8hlp,iwx" - Source: "00000000-00003208.00000002.70509.002F0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0t0r071http://crl3.digicert.com/cloudflareinceccca-3.crl071http://crl4.digicert.com/cloudflareinceccca-3.crl0vj0h0$http://ocsp.digicert.com0@4http://cacerts.digicert.com/cloudflareinceccca-3.crt0qhyfq" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digicert.com/omniroot2025.crl0mf0d070*0(https://www.digicert.com/cps09m^kwd8zw8hlp,iwx" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0zg\k:/" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5osalt" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynslk_\k9o_\k6" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!work1!0]pinternet1verisign," - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nsalt" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:nd" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entruscom1" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?$8\k88\k<8\k08\k48\k8\ki" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=enrz1.3.6.1.4.1.311.76.6.1eneo_wp" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://crl3.digicert.com/cloudflareinceccca-3.crl071http://crlv[kgi.com/cloudflareinceccca-3.crl0vj0h0$http://ocsp" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://cacerts.digicert.com/cloudflareinceccca-3.crt0:qhyfq" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)htt[kcrigicert.com/omniroot2025.crl0mf0d070*0([k//digicert.com/cps09m^kwd8zwwx" - Source: "00000000-00003208.00000002.70509.05240000.00000004.mdmp") Found URL "http://www.digicert.com/cps0t0r071http://crl3.digicert.com/cloudflareinceccca-3.crl071http://crl4.digicert.com/cloudflareinceccca-3.crl0vj0h0$http://ocsp.digicert.com0@4http://cacerts.digicert.com/cloudflareinceccca-3.crt0qhyfq" - Source: "00000000-00003208.00000002.70509.06510000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digicert.com/omniroot2025.crl0mf0d070*0(https://www.digicert.com/cps09m^kwd8zw8hlp,iwx" - Source: "00000000-00003208.00000002.70509.06510000.00000004.mdmp") Found URL "http://www.digicert.com/cps0<9iqmgvw,czc0?1$0" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0zg\k:/" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5osalt" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynslk_\k9o_\k6" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!work1!0]pinternet1verisign," - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nsalt" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:nd" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entruscom1" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?$8\k88\k<8\k08\k48\k313(8\ki" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=enrz1.3.6.1.4.1.311.76.6.1eneo6sp%_wp" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://crl3.digicer8mm/ht,ea*,eav,ea8m1>1gy'$dsz+t%ph,eameowkn7fgwtzh" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:)http://crl3.digicert.com/omniroot2025.crl0mf0d07https://www.digicert.com/cps09m^kwd8zw8hlp,iwx" - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00003208.00000003.75815.05240000.00000004.mdmp") Found URL "http://www.digicert.com/cps0t0r071http://crl3.digicert.com/cloudflareinceccca-3.crl071http://crl4.digicert.com/cloudflareinceccca-3.crl0vj0h0$http://ocsp.digicert.com0@4http://cacerts.digicert.com/cloudflareinceccca-3.crt0qhyfq" - Source: "00000000-00003208.00000003.75815.06510000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digicert.com/omniroot2025.crl0mf0d070*0(https://www.digicert.com/cps09m^kwd8zw8hlp,iwx" - Source: "00000000-00003208.00000003.75815.06510000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00003208.00000003.75815.06510000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateser9vms.0http://" - Source: "00000000-00003208.00000003.75815.06510000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003208.00000003.75815.06510000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00003208.00000003.75815.06510000.00000004.mdmp") Found URL "http://ocsp.digicert.com0:3010/)http://crl3.digicert.com/omniroot2025.crl0m0*0(https://www.digicert.com/cps09m^kwd8zw8hlp,iwx" - Source: "00000000-00003208.00000003.75815.06510000.00000004.mdmp") Found URL "http://crl3.digicert.com/cloudflareinceccca-3.crl071http://crl\", Potential IP \"4.0.0.0\" found in string \"4.0.0.0\n Culture=neu\", Potential IP \"0.0.0.0\" found in string \"0.0.0.0\n Cul\", Potential IP \"4.0.0.0\" found in string \"sion=4.0.0.0\n Culture=neutral\n PublicKeyToken=b77a5c561934e089\"/>\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3d","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"162.159.130.233\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"defounderzx.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"134285239\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"defounderzx.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"151062459\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"defounderzx.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$40","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; File: \"defounderzx.exe\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"defounderzx.exe\")\n Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001292.00000000.66442.01292000.00000020.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001292.00000000.66442.01292000.00000020.mdmp\")\n Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"00000000-00001292.00000000.66459.045D0000.00000004.mdmp\")\n Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003208.00000000.66666.01292000.00000020.mdmp, 00000000-00003208.00000003.75815.00400000.00000040.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00003208.00000000.66666.01292000.00000020.mdmp, 00000000-00003208.00000003.75815.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; File: \"defounderzx.exe\")\n Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001292.00000000.66442.01292000.00000020.mdmp\")\n Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003208.00000000.66666.01292000.00000020.mdmp, 00000000-00003208.00000003.75815.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001292.00000000.66459.045D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"024,,RtlGetVersion,NTDLL.dll\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003208.00000000.66666.002F0000.00000004.mdmp, 00000000-00003208.00000001.68589.002F0000.00000004.mdmp, 00000000-00003208.00000002.70509.002F0000.00000004.mdmp, 00000000-00003208.00000003.75815.002F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00001292.00000000.66459.045D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"defounderzx.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$42","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"defounderzx.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\cryptsp.dll\" (UID: 00000000-00003208)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$43","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"defounderzx.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"defounderzx.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"defounderzx.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"defounderzx.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"defounderzx.exe\" at 00000000-00001292-00000105-2008630\n \"defounderzx.exe\" at 00000000-00003208-00000105-1408182","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"defounderzx.exe\" queried SystemProcessInformation at 00000000-00003208-00000105-1583217 [PID: 3208]\n \"defounderzx.exe\" queried SystemProcessInformation at 00000000-00003208-00000105-1583801 [PID: 3208]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .rsrc with unusual entropies 7.94890328164\n 7.06111046702","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"select * from Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; Source: \"00000000-00003208.00000000.66666.002F0000.00000004.mdmp, 00000000-00003208.00000000.66666.01F40000.00000004.mdmp, 00000000-00003208.00000001.68589.002F0000.00000004.mdmp, 00000000-00003208.00000001.68589.01F40000.00000004.mdmp, 00000000-00003208.00000001.68589.05240000.00000004.mdmp, 00000000-00003208.00000002.70509.05240000.00000004.mdmp, 00000000-00003208.00000003.75815.05240000.00000004.mdmp\")\n \"FROM Win32_Processor\" (Indicator: \" win32_process\"; Source: \"00000000-00003208.00000000.66666.002F0000.00000004.mdmp\")\n \"SELECT * FROM Win32_Processor\" (Indicator: \" win32_process\"; Source: \"00000000-00003208.00000000.66666.002F0000.00000004.mdmp, 00000000-00003208.00000000.66666.01F40000.00000004.mdmp, 00000000-00003208.00000001.68589.002F0000.00000004.mdmp, 00000000-00003208.00000001.68589.01F40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"defounderzx.exe\" (Thread ID: 2288) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"defounderzx.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"45/71 Antivirus vendors marked sample as malicious (63% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"defounderzx.exe\" has resource with unusual entropy \"RT_ICON:7.85607255832\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"defounderzx.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 162.159.130.233 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00003208.00000000.66666.002F0000.00000004.mdmp, 00000000-00003208.00000000.66666.048E0000.00000004.mdmp, 00000000-00003208.00000000.66666.04C80000.00000004.mdmp, 00000000-00003208.00000001.68589.048E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"defounderzx.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"defounderzx.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"defounderzx.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks on FTP client related files","description":"\"defounderzx.exe\" opened file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\"\n \"defounderzx.exe\" opened file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\POCOMAIL\\ACCOUNTS.INI\"\n \"defounderzx.exe\" opened file \"%APPDATA%\\POCOMAIL\\ACCOUNTS.INI\"\n \"defounderzx.exe\" opened file \"%LOCALAPPDATA%\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\"","origin":"API Call","mitre_attack_id":"T1005","relevance":8,"id":"api-45","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access mail clients information (file access)","description":"$46","origin":"API Call","mitre_attack_id":"T1114","relevance":5,"id":"api-131","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetCurrentProcess\" (Source: defounderzx.exe, API is part of module: KERNELBASE.DLL)\n Found string \"select\" (Source: defounderzx.exe, API is part of module: WS2_32.DLL)\n Found string \"UnhookWindowsHookEx\" (Source: defounderzx.exe, API is part of module: USER32.DLL)\n Found string \"CallNextHookEx\" (Source: defounderzx.exe, API is part of module: USER32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"defounderzx.exe\" called \"CreateProcessA\" with parameter \"C:\\defounderzx.exe\" - (UID: 00000000-00001292)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"\"defounderzx.exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\defounderzx.exe\"\n which might be an injection preparation attempt ...","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"45/71 Antivirus vendors marked sample as malicious (63% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"43/81 Antivirus vendors marked spawned process \"defounderzx.exe\" (PID: 3208) as malicious (classified as \"IL:Trojan.MSILMamut\" with 53% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"defounderzx.exe\" allocated memory in \"C:\\defounderzx.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"defounderzx.exe\" wrote 32 bytes to a remote process \"C:\\defounderzx.exe\" (Handle: 608)\n \"defounderzx.exe\" wrote 52 bytes to a remote process \"C:\\defounderzx.exe\" (Handle: 608)\n \"defounderzx.exe\" wrote 4 bytes to a remote process \"C:\\defounderzx.exe\" (Handle: 608)\n \"defounderzx.exe\" wrote 512 bytes to a remote process \"C:\\defounderzx.exe\" (Handle: 608)\n \"defounderzx.exe\" wrote 247808 bytes to a remote process \"C:\\defounderzx.exe\" (Handle: 608)\n \"defounderzx.exe\" wrote 1536 bytes to a remote process \"C:\\defounderzx.exe\" (Handle: 608)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - AgentTesla","description":"YARA signature Malware.AgentTesla matched on process \"00000000-00003208\"","origin":"YARA Signature","relevance":10,"id":"yara-4","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$47","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$48","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":91,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6548c3c6b75841927c0ae9ce","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"IL:Trojan.MSILMamut","contacted_countries":["USA"],"submit_name":"defounderzx.exe","analysis_start_time":"2023-11-06T10:45:26+00:00","indicators_count":{"informative":114,"suspicious":32,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"162.159.130.233","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]}],"dns_resolutions":[{"domain":"discordapp.com","address":"162.159.130.233","ttl":300,"country":"United States","registrar_name":"ENOM, INC.","registrar_organization":"HAMMER & CHISEL INC.","registrar_name_servers":"GABE.NS.CLOUDFLARE.COM","registrar_creation_date":"2015-02-26T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}],"processes":[{"pid":1292,"ppid":0,"name":"defounderzx.exe","command_line":"","sha256":"bbf00e5d04d29ebf5fc920b7bc238170a714f3b8d0de3054550fb146468a16e6","normalized_path":"C:\\defounderzx.exe","uid":"00000000-00001292","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAA6klEQVR4Xu2TsQrCMBRF+2f9IAcHh9YPcFBq/spNEBTEwVUFFUnpolMkgxJvYux7iRGkBy60CTn3UdIs6+iIwFIelRnc/yq6cHbYvpTqtcVln3YQJMmX8JXovflu83Y/mEYM1SO4d131n2v62XyPhm8Ak9s6YrlZ6sp5NIhXhmCZL3g2GCxoE3SwQTEl6CKDQmrkpAgbAoWcoJMEyjhBJwmUcaLynDcEiriRovzxAFXARUQZJ+gkgTJO0EkCZZygk0QtCktICfpYoLR1pszb78KSf0jN/fV81FVpFbmC56JzGves0iTFHX/LHc1qYIpxSM/lAAAAAElFTkSuQmCC"},{"pid":3208,"ppid":1292,"name":"defounderzx.exe","command_line":"","sha256":"bbf00e5d04d29ebf5fc920b7bc238170a714f3b8d0de3054550fb146468a16e6","normalized_path":"C:\\defounderzx.exe","parent_uid":"00000000-00001292","uid":"00000000-00003208"}],"all_imported_dlls":["mscoreei.dll","clr.dll","shell32.dll","winhttp.dll","schannel.dll","bcryptprimitives.dll","psapi.dll","WindowsCodecs.dll","apphelp.dll","wbemsvc.dll","vaultcli.dll","rasman.dll","webio.dll","credssp.dll","api-ms-win-core-synch-l1-2-0.dll","advapi32.dll","sechost.dll","GdiPlus.dll","wmiutils.dll","WMINet_Utils.dll","userenv.dll","ucrtbase_clr0400.dll","uxtheme.dll","System.Configuration.ni.dll","nlssorting.dll","bcrypt.dll","dhcpcsvc6.dll","FWPUCLNT.DLL","dwmapi.dll","cryptsp.dll","mscoree.dll","KernelBase.dll","imm32.dll","msasn1.dll","ws2_32.dll","gdi32.dll","msctf.dll","version.dll","mscorrc.dll","wbemprox.dll","IPHLPAPI.DLL","user32.dll","shlwapi.dll","System.Drawing.ni.dll","System.Windows.Forms.ni.dll","System.Xml.ni.dll","profapi.dll","winnsi.dll","rasadhlp.dll","fltLib.dll","System.Windows.Forms.dll","System.Core.ni.dll","wbemcomn.dll","rtutils.dll","ncrypt.dll","nsi.dll","kernel32.dll","cryptbase.dll","comctl32.dll","fastprox.dll","dnsapi.dll","secur32.dll","rsaenh.dll","Microsoft.VisualBasic.ni.dll","dhcpcsvc.dll","msvcrt.dll","System.Security.ni.dll","crypt32.dll","api-ms-win-core-xstate-l2-1-0.dll","System.ni.dll","wship6.dll","gpapi.dll","vcruntime140_clr0400.dll","lpk.dll","usp10.dll","ole32.dll","clrjit.dll","mswsock.dll","cfgmgr32.dll","mscorlib.ni.dll","System.Management.ni.dll","ntdsapi.dll","rasapi32.dll","VxSSL32.dll","ntdll.dll","rpcrt4.dll","oleaut32.dll","clbcatq.dll","sspicli.dll","WSHTCPIP.DLL","RpcRtRemote.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"log.tmp","sha256":"0b74bf2ce2b91e1f1177a9199b38463bc16c75da5cc50645bd05330bd08eb652","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"path":"%TEMP%\\log.tmp","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"6548c3c6b75841927c0ae9ce"}]}]}},"report_ids":{"sandbox_job_ids":["6548c3c6b75841927c0ae9ce"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious IL:Trojan.MSILMamut Sample bbf00e5d04d2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample bbf00e5d04d2…. Malware family: IL:Trojan.MSILMamut. Threat score 100/100. 11/28 AV engines flagged this file. 11 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/bbf00e5d04d29ebf5fc920b7bc238170a714f3b8d0de3054550fb146468a16e6"}],["$","meta","4",{"property":"og:title","content":"Malicious IL:Trojan.MSILMamut Sample bbf00e5d04d2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample bbf00e5d04d2…. Malware family: IL:Trojan.MSILMamut. Threat score 100/100. 11/28 AV engines flagged this file. 11 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/bbf00e5d04d29ebf5fc920b7bc238170a714f3b8d0de3054550fb146468a16e6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious IL:Trojan.MSILMamut Sample bbf00e5d04d2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample bbf00e5d04d2…. Malware family: IL:Trojan.MSILMamut. Threat score 100/100. 11/28 AV engines flagged this file. 11 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L49","11",{}]]