Play interactive tour

Edit tour

Windows Analysis Report 2qTIaOLW2o

Overview

General Information

Sample Name:	2qTIaOLW2o (renamed file extension from none to dll)
Analysis ID:	492663
MD5:	8ad564b939e5a713e39154c7e566adc6
SHA1:	8cd069a890ab232fca75a17e324de60c426f3115
SHA256:	1fa221f1d5a2c006943c6986babc756890b79c2b38380403789e54f467e1a84c
Tags:	Dridexexe
Infos:
Most interesting Screenshot:

Detection

Dridex

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Dridex unpacked file

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Changes memory attributes in foreign processes to executable or writable

Contains functionality to hide windows to a different desktop

Queues an APC in another process (thread injection)

Machine Learning detection for dropped file

Contains functionality to automate explorer (e.g. start an application)

Uses Atom Bombing / ProGate to inject into other processes

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Queries the installation date of Windows

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Contains functionality to call native functions

Contains functionality to read the clipboard data

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Drops files with a non-matching file extension (content does not match file extension)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to launch a program with higher privileges

Binary contains a suspicious time stamp

PE file contains more sections than normal

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 5360 cmdline: loaddll64.exe 'C:\Users\user\Desktop\2qTIaOLW2o.dll' MD5: E0CC9D126C39A9D2FA1CAD5027EBBD18)

cmd.exe (PID: 5532 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\2qTIaOLW2o.dll',#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 5612 cmdline: rundll32.exe 'C:\Users\user\Desktop\2qTIaOLW2o.dll',#1 MD5: 73C519F050C20580F8A62C849D49215A)

explorer.exe (PID: 3472 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

SndVol.exe (PID: 2540 cmdline: C:\Windows\system32\SndVol.exe MD5: CDD7C7DF2D0859AC3F4088423D11BD08)

SndVol.exe (PID: 4928 cmdline: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe MD5: CDD7C7DF2D0859AC3F4088423D11BD08)

tabcal.exe (PID: 1488 cmdline: C:\Windows\system32\tabcal.exe MD5: F04F239BA5FED275E652372222D1BE00)

tabcal.exe (PID: 6012 cmdline: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe MD5: F04F239BA5FED275E652372222D1BE00)

ProximityUxHost.exe (PID: 4660 cmdline: C:\Windows\system32\ProximityUxHost.exe MD5: E7F0E9B3779E54CD271959C600A2A531)

ProximityUxHost.exe (PID: 1692 cmdline: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe MD5: E7F0E9B3779E54CD271959C600A2A531)

msinfo32.exe (PID: 3060 cmdline: C:\Windows\system32\msinfo32.exe MD5: C471C6B06F47EA1C66E5FAA8DFCEF108)

msinfo32.exe (PID: 2616 cmdline: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe MD5: C471C6B06F47EA1C66E5FAA8DFCEF108)

dpapimig.exe (PID: 5972 cmdline: C:\Windows\system32\dpapimig.exe MD5: EE7DB7B615B48D8F9F08FAE70CAF46D7)

dpapimig.exe (PID: 4628 cmdline: C:\Users\user\AppData\Local\famGrLP\dpapimig.exe MD5: EE7DB7B615B48D8F9F08FAE70CAF46D7)

dpapimig.exe (PID: 3104 cmdline: C:\Windows\system32\dpapimig.exe MD5: EE7DB7B615B48D8F9F08FAE70CAF46D7)

dpapimig.exe (PID: 1576 cmdline: C:\Users\user\AppData\Local\y7FgRNmA\dpapimig.exe MD5: EE7DB7B615B48D8F9F08FAE70CAF46D7)

SystemPropertiesPerformance.exe (PID: 5336 cmdline: C:\Windows\system32\SystemPropertiesPerformance.exe MD5: F325976CDC0F7E9C680B51B35D24D23A)

SystemPropertiesPerformance.exe (PID: 612 cmdline: C:\Users\user\AppData\Local\hbyq\SystemPropertiesPerformance.exe MD5: F325976CDC0F7E9C680B51B35D24D23A)

rundll32.exe (PID: 240 cmdline: rundll32.exe C:\Users\user\Desktop\2qTIaOLW2o.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 2920 cmdline: rundll32.exe C:\Users\user\Desktop\2qTIaOLW2o.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5156 cmdline: rundll32.exe C:\Users\user\Desktop\2qTIaOLW2o.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ MD5: 73C519F050C20580F8A62C849D49215A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.322869708.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
0000001C.00000002.412511294.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000021.00000002.441901323.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000008.00000002.253887228.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000004.00000002.245204685.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000026.00000002.511156934.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000009.00000002.261001867.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000016.00000002.352259211.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000023.00000002.478548185.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000018.00000002.379949090.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
00000028.00000002.536952423.0000000140001000.00000020.00020000.sdmp	JoeSecurity_Dridex_2	Yara detected Dridex unpacked file	Joe Security
Click to see the 7 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: 2qTIaOLW2o.dll	Virustotal: Detection: 67%			Perma Link
Source: 2qTIaOLW2o.dll	ReversingLabs: Detection: 75%

Antivirus / Scanner detection for submitted sample

Show sources

Source: 2qTIaOLW2o.dll

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\ScS40sYu\dwmapi.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\cAlXLQGkN\UxTheme.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\CsJaRZ\HID.DLL	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\famGrLP\DUI70.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\famGrLP\DUI70.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\ScS40sYu\dwmapi.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\N52IORg\WTSAPI32.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\52smNq1W\SLC.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\hbyq\SYSDM.CPL	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\famGrLP\DUI70.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\ScS40sYu\dwmapi.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\cAlXLQGkN\UxTheme.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\CsJaRZ\HID.DLL	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\famGrLP\DUI70.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\famGrLP\DUI70.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\ScS40sYu\dwmapi.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\N52IORg\WTSAPI32.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\52smNq1W\SLC.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\hbyq\SYSDM.CPL	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\famGrLP\DUI70.dll	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56B2E8C BCryptDestroyKey,BCryptCloseAlgorithmProvider,CoTaskMemFree,CoTaskMemFree,	28_2_00007FF6A56B2E8C
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56BCE10 memset,memcpy,BCryptEncrypt,BCryptDestroyKey,BCryptCloseAlgorithmProvider,CoTaskMemFree,	28_2_00007FF6A56BCE10
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56B2A04 BCryptDecrypt,memset,BCryptDecrypt,memcpy,BCryptDestroyKey,BCryptCloseAlgorithmProvider,CoTaskMemFree,	28_2_00007FF6A56B2A04
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56B2CA0 BCryptOpenAlgorithmProvider,BCryptGetProperty,BCryptGetProperty,BCryptGenerateSymmetricKey,BCryptDestroyKey,BCryptCloseAlgorithmProvider,CoTaskMemFree,	28_2_00007FF6A56B2CA0
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56BCC10 BCryptGenRandom,memcpy,BCryptEncrypt,memcpy,BCryptEncrypt,	28_2_00007FF6A56BCC10

Source: 2qTIaOLW2o.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: SndVol.pdbGCTL source: SndVol.exe, 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp, SndVol.exe.5.dr
Source:	Binary string: ProximityUxHost.pdbGCTL source: ProximityUxHost.exe, 0000001C.00000002.418174938.00007FF6A56C2000.00000002.00020000.sdmp, ProximityUxHost.exe.5.dr
Source:	Binary string: msinfo32.pdb source: msinfo32.exe, 00000021.00000002.443527978.00007FF7B2471000.00000002.00020000.sdmp, msinfo32.exe.5.dr
Source:	Binary string: dpapimig.pdbGCTL source: dpapimig.exe, 00000023.00000002.480133148.00007FF6882C4000.00000002.00020000.sdmp, dpapimig.exe, 00000026.00000002.512743904.00007FF675104000.00000002.00020000.sdmp, dpapimig.exe0.5.dr
Source:	Binary string: SystemPropertiesPerformance.pdb source: SystemPropertiesPerformance.exe, 00000028.00000000.515128617.00007FF605252000.00000002.00020000.sdmp, SystemPropertiesPerformance.exe.5.dr
Source:	Binary string: tabcal.pdbGCTL source: tabcal.exe, 00000018.00000000.356402567.00007FF6FB15A000.00000002.00020000.sdmp, tabcal.exe.5.dr
Source:	Binary string: rdpinit.pdb source: rdpinit.exe.5.dr
Source:	Binary string: SystemPropertiesPerformance.pdbGCTL source: SystemPropertiesPerformance.exe, 00000028.00000000.515128617.00007FF605252000.00000002.00020000.sdmp, SystemPropertiesPerformance.exe.5.dr
Source:	Binary string: rdpinit.pdbGCTL source: rdpinit.exe.5.dr
Source:	Binary string: GamePanel.pdbGCTL source: GamePanel.exe.5.dr
Source:	Binary string: LockScreenContentServer.pdbGCTL source: LockScreenContentServer.exe.5.dr
Source:	Binary string: dpapimig.pdb source: dpapimig.exe, 00000023.00000002.480133148.00007FF6882C4000.00000002.00020000.sdmp, dpapimig.exe, 00000026.00000002.512743904.00007FF675104000.00000002.00020000.sdmp, dpapimig.exe0.5.dr
Source:	Binary string: GamePanel.pdb source: GamePanel.exe.5.dr
Source:	Binary string: tabcal.pdb source: tabcal.exe, 00000018.00000000.356402567.00007FF6FB15A000.00000002.00020000.sdmp, tabcal.exe.5.dr
Source:	Binary string: msinfo32.pdbGCTL source: msinfo32.exe, 00000021.00000002.443527978.00007FF7B2471000.00000002.00020000.sdmp, msinfo32.exe.5.dr
Source:	Binary string: LockScreenContentServer.pdb source: LockScreenContentServer.exe.5.dr
Source:	Binary string: SndVol.pdb source: SndVol.exe, 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp, SndVol.exe.5.dr
Source:	Binary string: ProximityUxHost.pdb source: ProximityUxHost.exe, 0000001C.00000002.418174938.00007FF6A56C2000.00000002.00020000.sdmp, ProximityUxHost.exe.5.dr

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005D290 FindFirstFileExW,	0_2_000000014005D290
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B2466334 #620,#624,#6050,#1040,#1040,#4436,#1122,#1040,#624,#1259,#1040,#626,FindFirstFileW,#624,#1259,#1262,#1122,#1040,#1040,#1040,_wcsicmp,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,#624,#1259,#1040,FindFirstFileW,#622,#624,#624,#1259,#1259,#1040,#1040,#1040,#1040,#1040,FindNextFileW,FindClose,RemoveDirectoryW,#1040,#1040,#1040,#1040,	33_2_00007FF7B2466334
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B24672AC #624,FindFirstFileW,FindClose,#6050,_wcsicmp,#1040,#1463,_wcsicmp,#624,CreateFileW,GetFileSize,ReadFile,CloseHandle,#1040,CreateFileW,#6886,CloseHandle,#6886,_wcsicmp,#626,#624,#1040,#624,#1122,SetupIterateCabinetW,#1040,#626,#626,RegOpenKeyExW,RegGetValueW,#1126,RegCloseKey,#1040,#1040,#1040,RegOpenKeyExW,#624,#2975,RegSetValueExW,#1122,RegCloseKey,#1040,RegCloseKey,#620,#620,#628,#1042,#1040,#1040,#622,#1259,#1122,#1040,#1040,#1284,#2783,#1040,#1040,#1040,#1042,#1040,#1040,#1040,#1040,#1040,#1040,GetLastError,#626,#626,#4473,#4473,#1287,#1287,MessageBoxW,#1040,#1040,#1040,	33_2_00007FF7B24672AC
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B2465DE8 #626,#626,#1122,#624,#6050,#1040,#1040,#624,#1284,#1040,#1259,#1122,#1040,FindFirstFileW,#624,#1259,#1358,#1040,#1040,FindNextFileW,FindClose,#624,#1259,#1122,#1040,#1040,FindFirstFileW,#624,#1259,#1040,#1040,FindNextFileW,FindClose,#1040,#1040,	33_2_00007FF7B2465DE8

Source: SndVol.exe, 00000015.00000002.327014978.00000242A3690000.00000002.00020000.sdmp	String found in binary or memory: http://schemas.micro
Source: GamePanel.exe.5.dr	String found in binary or memory: https://MediaData.XboxLive.com/broadcasts/Augmenthttps://MediaData.XboxLive.com/screenshots/Augmenth
Source: GamePanel.exe.5.dr	String found in binary or memory: https://aka.ms/w5ryqnhttps://aka.ms/imfx4kQUITTING
Source: GamePanel.exe.5.dr	String found in binary or memory: https://aka.ms/wk9ocd
Source: GamePanel.exe.5.dr	String found in binary or memory: https://mixer.com/%wsWindows.System.Launcher
Source: GamePanel.exe.5.dr	String found in binary or memory: https://mixer.com/_latest/assets/emoticons/%ls.pngtitleIdaumIdkglIdprocessNamenametypeIdmultimedia
Source: GamePanel.exe.5.dr	String found in binary or memory: https://mixer.com/api/v1/broadcasts/current
Source: GamePanel.exe.5.dr	String found in binary or memory: https://mixer.com/api/v1/chats/%.0fhttps://mixer.com/api/v1/users/currentBEAM_IMAGEGamesGuide::BeamC
Source: GamePanel.exe.5.dr	String found in binary or memory: https://mixer.com/api/v1/types/lookup%wshttps://mixer.com/api/v1/channels/%wshttps://mixer.com/api/v
Source: GamePanel.exe.5.dr	String found in binary or memory: https://www.xboxlive.comMBI_SSLhttps://profile.xboxlive.com/users/me/profile/settings?settings=GameD

Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe

Code function: 33_2_00007FF7B2467D98 LoadCursorW,SetCursor,SetCursor,IsDlgButtonChecked,IsDlgButtonChecked,CheckDlgButton,GetDlgItem,GetWindowTextW,#1126,SendMessageW,PostMessageW,SendMessageW,SendMessageW,LoadIconW,LoadStringW,ShellAboutW,DestroyIcon,GetFocus,IsWindowEnabled,IsWindowEnabled,GetFocus,IsWindowVisible,IsWindowEnabled,OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,#624,#2781,#5979,SendMessageW,GlobalUnlock,#1040,CloseClipboard,SendMessageW,

33_2_00007FF7B2467D98

Source: GamePanel.exe.5.dr

Binary or memory string: RegisterRawInputDevices

Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe

Code function: 33_2_00007FF7B246A9C4 GetFocus,IsWindowVisible,IsWindowEnabled,SendMessageW,#626,#1126,SendMessageW,SendMessageW,#1287,#1284,#1287,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,#1040,

33_2_00007FF7B246A9C4

E-Banking Fraud:

Yara detected Dridex unpacked file

Show sources

Source: Yara match	File source: 00000002.00000002.322869708.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.412511294.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.441901323.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.253887228.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.245204685.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.511156934.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.261001867.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.352259211.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.478548185.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.379949090.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.536952423.0000000140001000.00000020.00020000.sdmp, type: MEMORY

Protection of GUI:

Contains functionality to hide windows to a different desktop

Show sources

Source: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe

Code function: 24_2_00007FF6FB151F10 ImmDisableTextFrameService,_wcslwr,GetCurrentThreadId,GetThreadDesktop,CreateDesktopW,SetThreadDesktop,SwitchDesktop,CloseDesktop,memset,LoadIconW,LoadCursorW,RegisterClassExW,CreateWindowExW,ShowWindow,PostMessageW,TranslateMessage,DispatchMessageW,GetMessageW,UnregisterClassW,DestroyInteractionContext,free,free,SwitchDesktop,CloseDesktop,

24_2_00007FF6FB151F10

Source: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe

24_2_00007FF6FB151F10

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140034870	0_2_0000000140034870
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140035270	0_2_0000000140035270
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140048AC0	0_2_0000000140048AC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005C340	0_2_000000014005C340
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140065B80	0_2_0000000140065B80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006A4B0	0_2_000000014006A4B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400524B0	0_2_00000001400524B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140026CC0	0_2_0000000140026CC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014004BD40	0_2_000000014004BD40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400495B0	0_2_00000001400495B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140036F30	0_2_0000000140036F30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140069010	0_2_0000000140069010
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140001010	0_2_0000000140001010
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140066020	0_2_0000000140066020
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002F840	0_2_000000014002F840
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005D850	0_2_000000014005D850
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140064080	0_2_0000000140064080
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140010880	0_2_0000000140010880
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400688A0	0_2_00000001400688A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002D0D0	0_2_000000014002D0D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400018D0	0_2_00000001400018D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140016100	0_2_0000000140016100
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014001D100	0_2_000000014001D100
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002A110	0_2_000000014002A110
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014001D910	0_2_000000014001D910
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140015120	0_2_0000000140015120
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000B120	0_2_000000014000B120
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014004F940	0_2_000000014004F940
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140039140	0_2_0000000140039140
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140023140	0_2_0000000140023140
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140057950	0_2_0000000140057950
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014001E170	0_2_000000014001E170
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140002980	0_2_0000000140002980
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400611A0	0_2_00000001400611A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400389A0	0_2_00000001400389A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400381A0	0_2_00000001400381A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002E1B0	0_2_000000014002E1B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400139D0	0_2_00000001400139D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400319F0	0_2_00000001400319F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002EA00	0_2_000000014002EA00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022A00	0_2_0000000140022A00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003B220	0_2_000000014003B220
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140067A40	0_2_0000000140067A40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140069A50	0_2_0000000140069A50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140007A60	0_2_0000000140007A60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003AAC0	0_2_000000014003AAC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003A2E0	0_2_000000014003A2E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140062B00	0_2_0000000140062B00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140018300	0_2_0000000140018300
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002FB20	0_2_000000014002FB20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140031340	0_2_0000000140031340
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022340	0_2_0000000140022340
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140017B40	0_2_0000000140017B40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000BB40	0_2_000000014000BB40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014004EB60	0_2_000000014004EB60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140005370	0_2_0000000140005370
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002CB80	0_2_000000014002CB80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B390	0_2_000000014006B390
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140054BA0	0_2_0000000140054BA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140033BB0	0_2_0000000140033BB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400263C0	0_2_00000001400263C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400123C0	0_2_00000001400123C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140063BD0	0_2_0000000140063BD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400663F0	0_2_00000001400663F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140023BF0	0_2_0000000140023BF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B41B	0_2_000000014006B41B
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B424	0_2_000000014006B424
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B42D	0_2_000000014006B42D
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B436	0_2_000000014006B436
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B43D	0_2_000000014006B43D
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140024440	0_2_0000000140024440
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140005C40	0_2_0000000140005C40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B446	0_2_000000014006B446
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005F490	0_2_000000014005F490
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022D00	0_2_0000000140022D00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140035520	0_2_0000000140035520
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140019D20	0_2_0000000140019D20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140030530	0_2_0000000140030530
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140023530	0_2_0000000140023530
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140031540	0_2_0000000140031540
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140033540	0_2_0000000140033540
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014007BD50	0_2_000000014007BD50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140078570	0_2_0000000140078570
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140019580	0_2_0000000140019580
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400205A0	0_2_00000001400205A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140025DB0	0_2_0000000140025DB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140071DC0	0_2_0000000140071DC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000C5C0	0_2_000000014000C5C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002DDE0	0_2_000000014002DDE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140031DF0	0_2_0000000140031DF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000DDF0	0_2_000000014000DDF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140001620	0_2_0000000140001620
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140018630	0_2_0000000140018630
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140032650	0_2_0000000140032650
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140064E80	0_2_0000000140064E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140016E80	0_2_0000000140016E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140007EA0	0_2_0000000140007EA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400286B0	0_2_00000001400286B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140006EB0	0_2_0000000140006EB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400276C0	0_2_00000001400276C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002FEC0	0_2_000000014002FEC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002EED0	0_2_000000014002EED0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002B6E0	0_2_000000014002B6E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140053F20	0_2_0000000140053F20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022730	0_2_0000000140022730
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140029780	0_2_0000000140029780
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140018F80	0_2_0000000140018F80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003EFB0	0_2_000000014003EFB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400067B0	0_2_00000001400067B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400667D0	0_2_00000001400667D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140060FE0	0_2_0000000140060FE0
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153D8310	22_2_00007FF6153D8310
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153E4F10	22_2_00007FF6153E4F10
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153E3718	22_2_00007FF6153E3718
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153DA1A0	22_2_00007FF6153DA1A0
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153D6218	22_2_00007FF6153D6218
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153DA5C8	22_2_00007FF6153DA5C8
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153D3080	22_2_00007FF6153D3080
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153EB088	22_2_00007FF6153EB088
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153E0CA8	22_2_00007FF6153E0CA8
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153D3514	22_2_00007FF6153D3514
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153EC4D0	22_2_00007FF6153EC4D0
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153D44E8	22_2_00007FF6153D44E8
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153E03A0	22_2_00007FF6153E03A0
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153E2BD8	22_2_00007FF6153E2BD8
Source: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe	Code function: 24_2_00007FF6FB1533E0	24_2_00007FF6FB1533E0
Source: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe	Code function: 24_2_00007FF6FB1517E0	24_2_00007FF6FB1517E0
Source: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe	Code function: 24_2_00007FF6FB1515D0	24_2_00007FF6FB1515D0
Source: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe	Code function: 24_2_00007FF6FB155A18	24_2_00007FF6FB155A18
Source: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe	Code function: 24_2_00007FF6FB1525FC	24_2_00007FF6FB1525FC
Source: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe	Code function: 24_2_00007FF6FB154F00	24_2_00007FF6FB154F00
Source: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe	Code function: 24_2_00007FF6FB151F10	24_2_00007FF6FB151F10
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56BD6B0	28_2_00007FF6A56BD6B0
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56A9A7C	28_2_00007FF6A56A9A7C
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56BB260	28_2_00007FF6A56BB260
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A5695B08	28_2_00007FF6A5695B08
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56A92C0	28_2_00007FF6A56A92C0
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56B4960	28_2_00007FF6A56B4960
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56A4158	28_2_00007FF6A56A4158
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A569913C	28_2_00007FF6A569913C
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56A45BC	28_2_00007FF6A56A45BC
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A569F0B4	28_2_00007FF6A569F0B4
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A569B868	28_2_00007FF6A569B868
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56B9530	28_2_00007FF6A56B9530
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56BA8E0	28_2_00007FF6A56BA8E0
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56AECB8	28_2_00007FF6A56AECB8
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56ACF68	28_2_00007FF6A56ACF68
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56B9F38	28_2_00007FF6A56B9F38
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56A1018	28_2_00007FF6A56A1018
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56A8408	28_2_00007FF6A56A8408
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56B7400	28_2_00007FF6A56B7400
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56B0800	28_2_00007FF6A56B0800
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B2459370	33_2_00007FF7B2459370
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B246BD00	33_2_00007FF7B246BD00
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B246B184	33_2_00007FF7B246B184
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B2462210	33_2_00007FF7B2462210
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B245C314	33_2_00007FF7B245C314
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B24672AC	33_2_00007FF7B24672AC
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B246B7AC	33_2_00007FF7B246B7AC
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B2460F98	33_2_00007FF7B2460F98
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B24608D8	33_2_00007FF7B24608D8
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B245B0E0	33_2_00007FF7B245B0E0
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B2467D98	33_2_00007FF7B2467D98
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B246A670	33_2_00007FF7B246A670
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B2459E90	33_2_00007FF7B2459E90
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B24666F8	33_2_00007FF7B24666F8
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B2468F04	33_2_00007FF7B2468F04
Source: C:\Users\user\AppData\Local\famGrLP\dpapimig.exe	Code function: 35_2_00007FF6882C1F08	35_2_00007FF6882C1F08
Source: C:\Users\user\AppData\Local\y7FgRNmA\dpapimig.exe	Code function: 38_2_00007FF675101F08	38_2_00007FF675101F08

Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe

Code function: String function: 00007FF7B24589B8 appears 46 times

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140046C90 NtClose,	0_2_0000000140046C90
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006A4B0 NtQuerySystemInformation,RtlAllocateHeap,	0_2_000000014006A4B0
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B24607E8 #626,#626,#4473,#4473,NtQuerySystemInformation,#4473,#1040,#1040,	33_2_00007FF7B24607E8

Source: 2qTIaOLW2o.dll

Binary or memory string: OriginalFilenamekbdyj% vs 2qTIaOLW2o.dll

Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tabcal.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tabcal.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tabcal.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dpapimig.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dpapimig.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dpapimig.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dpapimig.exe0.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dpapimig.exe0.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dpapimig.exe0.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesPerformance.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesPerformance.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesPerformance.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: GamePanel.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: GamePanel.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: GamePanel.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe

Section loaded: capabilityaccessmanagerclient.dll

Jump to behavior

Source: DUI70.dll0.5.dr	Static PE information: Number of sections : 35 > 10
Source: DUI70.dll.5.dr	Static PE information: Number of sections : 35 > 10
Source: WTSAPI32.dll.5.dr	Static PE information: Number of sections : 35 > 10
Source: HID.DLL.5.dr	Static PE information: Number of sections : 35 > 10
Source: DUI70.dll1.5.dr	Static PE information: Number of sections : 35 > 10
Source: SYSDM.CPL.5.dr	Static PE information: Number of sections : 35 > 10
Source: SLC.dll.5.dr	Static PE information: Number of sections : 35 > 10
Source: UxTheme.dll.5.dr	Static PE information: Number of sections : 35 > 10
Source: dwmapi.dll0.5.dr	Static PE information: Number of sections : 35 > 10
Source: 2qTIaOLW2o.dll	Static PE information: Number of sections : 34 > 10
Source: dwmapi.dll.5.dr	Static PE information: Number of sections : 35 > 10

Source: 2qTIaOLW2o.dll	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: UxTheme.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: HID.DLL.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DUI70.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SLC.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DUI70.dll0.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DUI70.dll1.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SYSDM.CPL.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dwmapi.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dwmapi.dll0.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WTSAPI32.dll.5.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 2qTIaOLW2o.dll	Virustotal: Detection: 67%
Source: 2qTIaOLW2o.dll	ReversingLabs: Detection: 75%

Source: 2qTIaOLW2o.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe 'C:\Users\user\Desktop\2qTIaOLW2o.dll'
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\2qTIaOLW2o.dll',#1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\2qTIaOLW2o.dll',#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\2qTIaOLW2o.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\2qTIaOLW2o.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\2qTIaOLW2o.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SndVol.exe C:\Windows\system32\SndVol.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\tabcal.exe C:\Windows\system32\tabcal.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\ProximityUxHost.exe C:\Windows\system32\ProximityUxHost.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\msinfo32.exe C:\Windows\system32\msinfo32.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\dpapimig.exe C:\Windows\system32\dpapimig.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\famGrLP\dpapimig.exe C:\Users\user\AppData\Local\famGrLP\dpapimig.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\dpapimig.exe C:\Windows\system32\dpapimig.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\y7FgRNmA\dpapimig.exe C:\Users\user\AppData\Local\y7FgRNmA\dpapimig.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SystemPropertiesPerformance.exe C:\Windows\system32\SystemPropertiesPerformance.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\hbyq\SystemPropertiesPerformance.exe C:\Users\user\AppData\Local\hbyq\SystemPropertiesPerformance.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\2qTIaOLW2o.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\2qTIaOLW2o.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\2qTIaOLW2o.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\2qTIaOLW2o.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\2qTIaOLW2o.dll',#1	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SndVol.exe C:\Windows\system32\SndVol.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\tabcal.exe C:\Windows\system32\tabcal.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\ProximityUxHost.exe C:\Windows\system32\ProximityUxHost.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\msinfo32.exe C:\Windows\system32\msinfo32.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\dpapimig.exe C:\Windows\system32\dpapimig.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\famGrLP\dpapimig.exe C:\Users\user\AppData\Local\famGrLP\dpapimig.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\dpapimig.exe C:\Windows\system32\dpapimig.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\y7FgRNmA\dpapimig.exe C:\Users\user\AppData\Local\y7FgRNmA\dpapimig.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SystemPropertiesPerformance.exe C:\Windows\system32\SystemPropertiesPerformance.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\hbyq\SystemPropertiesPerformance.exe C:\Users\user\AppData\Local\hbyq\SystemPropertiesPerformance.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@45/21@0/0

Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe

Code function: 22_2_00007FF6153E1D64 CoCreateInstance,ImageList_Create,GetSysColor,ImageList_SetBkColor,

22_2_00007FF6153E1D64

Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe

Code function: 28_2_00007FF6A569D49C FormatMessageW,GetLastError,

28_2_00007FF6A569D49C

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\2qTIaOLW2o.dll',#1

Source: C:\Users\user\AppData\Local\hbyq\SystemPropertiesPerformance.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1393df40-fb89-1875-a7b8-1174748e042d}
Source: C:\Users\user\AppData\Local\hbyq\SystemPropertiesPerformance.exe	Mutant created: \Sessions\1\BaseNamedObjects\{03473c0b-b89b-1ce4-9ab2-634393a4b7a9}

Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe

Code function: 22_2_00007FF6153D8E7C LoadResource,LockResource,SizeofResource,

22_2_00007FF6153D8E7C

Source: 2qTIaOLW2o.dll

Static PE information: More than 4319 > 100 exports found

Source: 2qTIaOLW2o.dll

Static PE information: Image base 0x140000000 > 0x60000000

Source: 2qTIaOLW2o.dll

Static file information: File size 1503232 > 1048576

Source: 2qTIaOLW2o.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: SndVol.pdbGCTL source: SndVol.exe, 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp, SndVol.exe.5.dr
Source:	Binary string: ProximityUxHost.pdbGCTL source: ProximityUxHost.exe, 0000001C.00000002.418174938.00007FF6A56C2000.00000002.00020000.sdmp, ProximityUxHost.exe.5.dr
Source:	Binary string: msinfo32.pdb source: msinfo32.exe, 00000021.00000002.443527978.00007FF7B2471000.00000002.00020000.sdmp, msinfo32.exe.5.dr
Source:	Binary string: dpapimig.pdbGCTL source: dpapimig.exe, 00000023.00000002.480133148.00007FF6882C4000.00000002.00020000.sdmp, dpapimig.exe, 00000026.00000002.512743904.00007FF675104000.00000002.00020000.sdmp, dpapimig.exe0.5.dr
Source:	Binary string: SystemPropertiesPerformance.pdb source: SystemPropertiesPerformance.exe, 00000028.00000000.515128617.00007FF605252000.00000002.00020000.sdmp, SystemPropertiesPerformance.exe.5.dr
Source:	Binary string: tabcal.pdbGCTL source: tabcal.exe, 00000018.00000000.356402567.00007FF6FB15A000.00000002.00020000.sdmp, tabcal.exe.5.dr
Source:	Binary string: rdpinit.pdb source: rdpinit.exe.5.dr
Source:	Binary string: SystemPropertiesPerformance.pdbGCTL source: SystemPropertiesPerformance.exe, 00000028.00000000.515128617.00007FF605252000.00000002.00020000.sdmp, SystemPropertiesPerformance.exe.5.dr
Source:	Binary string: rdpinit.pdbGCTL source: rdpinit.exe.5.dr
Source:	Binary string: GamePanel.pdbGCTL source: GamePanel.exe.5.dr
Source:	Binary string: LockScreenContentServer.pdbGCTL source: LockScreenContentServer.exe.5.dr
Source:	Binary string: dpapimig.pdb source: dpapimig.exe, 00000023.00000002.480133148.00007FF6882C4000.00000002.00020000.sdmp, dpapimig.exe, 00000026.00000002.512743904.00007FF675104000.00000002.00020000.sdmp, dpapimig.exe0.5.dr
Source:	Binary string: GamePanel.pdb source: GamePanel.exe.5.dr
Source:	Binary string: tabcal.pdb source: tabcal.exe, 00000018.00000000.356402567.00007FF6FB15A000.00000002.00020000.sdmp, tabcal.exe.5.dr
Source:	Binary string: msinfo32.pdbGCTL source: msinfo32.exe, 00000021.00000002.443527978.00007FF7B2471000.00000002.00020000.sdmp, msinfo32.exe.5.dr
Source:	Binary string: LockScreenContentServer.pdb source: LockScreenContentServer.exe.5.dr
Source:	Binary string: SndVol.pdb source: SndVol.exe, 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp, SndVol.exe.5.dr
Source:	Binary string: ProximityUxHost.pdb source: ProximityUxHost.exe, 0000001C.00000002.418174938.00007FF6A56C2000.00000002.00020000.sdmp, ProximityUxHost.exe.5.dr

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000000140056A4D push rdi; ret

0_2_0000000140056A4E

Source: 2qTIaOLW2o.dll	Static PE information: section name: .qkm
Source: 2qTIaOLW2o.dll	Static PE information: section name: .cvjb
Source: 2qTIaOLW2o.dll	Static PE information: section name: .tlmkv
Source: 2qTIaOLW2o.dll	Static PE information: section name: .wucsxe
Source: 2qTIaOLW2o.dll	Static PE information: section name: .wnx
Source: 2qTIaOLW2o.dll	Static PE information: section name: .weqy
Source: 2qTIaOLW2o.dll	Static PE information: section name: .yby
Source: 2qTIaOLW2o.dll	Static PE information: section name: .ormx
Source: 2qTIaOLW2o.dll	Static PE information: section name: .dhclu
Source: 2qTIaOLW2o.dll	Static PE information: section name: .xmiul
Source: 2qTIaOLW2o.dll	Static PE information: section name: .tlwcxe
Source: 2qTIaOLW2o.dll	Static PE information: section name: .get
Source: 2qTIaOLW2o.dll	Static PE information: section name: .hzrd
Source: 2qTIaOLW2o.dll	Static PE information: section name: .gfrpb
Source: 2qTIaOLW2o.dll	Static PE information: section name: .ymlijr
Source: 2qTIaOLW2o.dll	Static PE information: section name: .tntrb
Source: 2qTIaOLW2o.dll	Static PE information: section name: .rmvhl
Source: 2qTIaOLW2o.dll	Static PE information: section name: .ukcyi
Source: 2qTIaOLW2o.dll	Static PE information: section name: .knmra
Source: 2qTIaOLW2o.dll	Static PE information: section name: .wtn
Source: 2qTIaOLW2o.dll	Static PE information: section name: .kjnw
Source: 2qTIaOLW2o.dll	Static PE information: section name: .okpgp
Source: 2qTIaOLW2o.dll	Static PE information: section name: .oxbitk
Source: 2qTIaOLW2o.dll	Static PE information: section name: .dplkzo
Source: 2qTIaOLW2o.dll	Static PE information: section name: .psnue
Source: 2qTIaOLW2o.dll	Static PE information: section name: .lida
Source: 2qTIaOLW2o.dll	Static PE information: section name: .arovjd
Source: 2qTIaOLW2o.dll	Static PE information: section name: .xsnm
Source: SndVol.exe.5.dr	Static PE information: section name: .imrsiv
Source: SndVol.exe.5.dr	Static PE information: section name: .didat
Source: tabcal.exe.5.dr	Static PE information: section name: .didat
Source: ProximityUxHost.exe.5.dr	Static PE information: section name: .imrsiv
Source: GamePanel.exe.5.dr	Static PE information: section name: .imrsiv
Source: GamePanel.exe.5.dr	Static PE information: section name: .didat
Source: rdpinit.exe.5.dr	Static PE information: section name: .imrsiv
Source: UxTheme.dll.5.dr	Static PE information: section name: .qkm
Source: UxTheme.dll.5.dr	Static PE information: section name: .cvjb
Source: UxTheme.dll.5.dr	Static PE information: section name: .tlmkv
Source: UxTheme.dll.5.dr	Static PE information: section name: .wucsxe
Source: UxTheme.dll.5.dr	Static PE information: section name: .wnx
Source: UxTheme.dll.5.dr	Static PE information: section name: .weqy
Source: UxTheme.dll.5.dr	Static PE information: section name: .yby
Source: UxTheme.dll.5.dr	Static PE information: section name: .ormx
Source: UxTheme.dll.5.dr	Static PE information: section name: .dhclu
Source: UxTheme.dll.5.dr	Static PE information: section name: .xmiul
Source: UxTheme.dll.5.dr	Static PE information: section name: .tlwcxe
Source: UxTheme.dll.5.dr	Static PE information: section name: .get
Source: UxTheme.dll.5.dr	Static PE information: section name: .hzrd
Source: UxTheme.dll.5.dr	Static PE information: section name: .gfrpb
Source: UxTheme.dll.5.dr	Static PE information: section name: .ymlijr
Source: UxTheme.dll.5.dr	Static PE information: section name: .tntrb
Source: UxTheme.dll.5.dr	Static PE information: section name: .rmvhl
Source: UxTheme.dll.5.dr	Static PE information: section name: .ukcyi
Source: UxTheme.dll.5.dr	Static PE information: section name: .knmra
Source: UxTheme.dll.5.dr	Static PE information: section name: .wtn
Source: UxTheme.dll.5.dr	Static PE information: section name: .kjnw
Source: UxTheme.dll.5.dr	Static PE information: section name: .okpgp
Source: UxTheme.dll.5.dr	Static PE information: section name: .oxbitk
Source: UxTheme.dll.5.dr	Static PE information: section name: .dplkzo
Source: UxTheme.dll.5.dr	Static PE information: section name: .psnue
Source: UxTheme.dll.5.dr	Static PE information: section name: .lida
Source: UxTheme.dll.5.dr	Static PE information: section name: .arovjd
Source: UxTheme.dll.5.dr	Static PE information: section name: .xsnm
Source: UxTheme.dll.5.dr	Static PE information: section name: .kqfi
Source: HID.DLL.5.dr	Static PE information: section name: .qkm
Source: HID.DLL.5.dr	Static PE information: section name: .cvjb
Source: HID.DLL.5.dr	Static PE information: section name: .tlmkv
Source: HID.DLL.5.dr	Static PE information: section name: .wucsxe
Source: HID.DLL.5.dr	Static PE information: section name: .wnx
Source: HID.DLL.5.dr	Static PE information: section name: .weqy
Source: HID.DLL.5.dr	Static PE information: section name: .yby
Source: HID.DLL.5.dr	Static PE information: section name: .ormx
Source: HID.DLL.5.dr	Static PE information: section name: .dhclu
Source: HID.DLL.5.dr	Static PE information: section name: .xmiul
Source: HID.DLL.5.dr	Static PE information: section name: .tlwcxe
Source: HID.DLL.5.dr	Static PE information: section name: .get
Source: HID.DLL.5.dr	Static PE information: section name: .hzrd
Source: HID.DLL.5.dr	Static PE information: section name: .gfrpb
Source: HID.DLL.5.dr	Static PE information: section name: .ymlijr
Source: HID.DLL.5.dr	Static PE information: section name: .tntrb
Source: HID.DLL.5.dr	Static PE information: section name: .rmvhl
Source: HID.DLL.5.dr	Static PE information: section name: .ukcyi
Source: HID.DLL.5.dr	Static PE information: section name: .knmra
Source: HID.DLL.5.dr	Static PE information: section name: .wtn
Source: HID.DLL.5.dr	Static PE information: section name: .kjnw
Source: HID.DLL.5.dr	Static PE information: section name: .okpgp
Source: HID.DLL.5.dr	Static PE information: section name: .oxbitk
Source: HID.DLL.5.dr	Static PE information: section name: .dplkzo
Source: HID.DLL.5.dr	Static PE information: section name: .psnue
Source: HID.DLL.5.dr	Static PE information: section name: .lida
Source: HID.DLL.5.dr	Static PE information: section name: .arovjd
Source: HID.DLL.5.dr	Static PE information: section name: .xsnm
Source: HID.DLL.5.dr	Static PE information: section name: .suz
Source: DUI70.dll.5.dr	Static PE information: section name: .qkm
Source: DUI70.dll.5.dr	Static PE information: section name: .cvjb
Source: DUI70.dll.5.dr	Static PE information: section name: .tlmkv
Source: DUI70.dll.5.dr	Static PE information: section name: .wucsxe
Source: DUI70.dll.5.dr	Static PE information: section name: .wnx
Source: DUI70.dll.5.dr	Static PE information: section name: .weqy
Source: DUI70.dll.5.dr	Static PE information: section name: .yby
Source: DUI70.dll.5.dr	Static PE information: section name: .ormx
Source: DUI70.dll.5.dr	Static PE information: section name: .dhclu
Source: DUI70.dll.5.dr	Static PE information: section name: .xmiul
Source: DUI70.dll.5.dr	Static PE information: section name: .tlwcxe
Source: DUI70.dll.5.dr	Static PE information: section name: .get
Source: DUI70.dll.5.dr	Static PE information: section name: .hzrd
Source: DUI70.dll.5.dr	Static PE information: section name: .gfrpb
Source: DUI70.dll.5.dr	Static PE information: section name: .ymlijr
Source: DUI70.dll.5.dr	Static PE information: section name: .tntrb
Source: DUI70.dll.5.dr	Static PE information: section name: .rmvhl
Source: DUI70.dll.5.dr	Static PE information: section name: .ukcyi
Source: DUI70.dll.5.dr	Static PE information: section name: .knmra
Source: DUI70.dll.5.dr	Static PE information: section name: .wtn
Source: DUI70.dll.5.dr	Static PE information: section name: .kjnw
Source: DUI70.dll.5.dr	Static PE information: section name: .okpgp
Source: DUI70.dll.5.dr	Static PE information: section name: .oxbitk
Source: DUI70.dll.5.dr	Static PE information: section name: .dplkzo
Source: DUI70.dll.5.dr	Static PE information: section name: .psnue
Source: DUI70.dll.5.dr	Static PE information: section name: .lida
Source: DUI70.dll.5.dr	Static PE information: section name: .arovjd
Source: DUI70.dll.5.dr	Static PE information: section name: .xsnm
Source: DUI70.dll.5.dr	Static PE information: section name: .amc
Source: SLC.dll.5.dr	Static PE information: section name: .qkm
Source: SLC.dll.5.dr	Static PE information: section name: .cvjb
Source: SLC.dll.5.dr	Static PE information: section name: .tlmkv
Source: SLC.dll.5.dr	Static PE information: section name: .wucsxe
Source: SLC.dll.5.dr	Static PE information: section name: .wnx
Source: SLC.dll.5.dr	Static PE information: section name: .weqy
Source: SLC.dll.5.dr	Static PE information: section name: .yby
Source: SLC.dll.5.dr	Static PE information: section name: .ormx
Source: SLC.dll.5.dr	Static PE information: section name: .dhclu
Source: SLC.dll.5.dr	Static PE information: section name: .xmiul
Source: SLC.dll.5.dr	Static PE information: section name: .tlwcxe
Source: SLC.dll.5.dr	Static PE information: section name: .get
Source: SLC.dll.5.dr	Static PE information: section name: .hzrd
Source: SLC.dll.5.dr	Static PE information: section name: .gfrpb
Source: SLC.dll.5.dr	Static PE information: section name: .ymlijr
Source: SLC.dll.5.dr	Static PE information: section name: .tntrb
Source: SLC.dll.5.dr	Static PE information: section name: .rmvhl
Source: SLC.dll.5.dr	Static PE information: section name: .ukcyi
Source: SLC.dll.5.dr	Static PE information: section name: .knmra
Source: SLC.dll.5.dr	Static PE information: section name: .wtn
Source: SLC.dll.5.dr	Static PE information: section name: .kjnw
Source: SLC.dll.5.dr	Static PE information: section name: .okpgp
Source: SLC.dll.5.dr	Static PE information: section name: .oxbitk
Source: SLC.dll.5.dr	Static PE information: section name: .dplkzo
Source: SLC.dll.5.dr	Static PE information: section name: .psnue
Source: SLC.dll.5.dr	Static PE information: section name: .lida
Source: SLC.dll.5.dr	Static PE information: section name: .arovjd
Source: SLC.dll.5.dr	Static PE information: section name: .xsnm
Source: SLC.dll.5.dr	Static PE information: section name: .jsl
Source: DUI70.dll0.5.dr	Static PE information: section name: .qkm
Source: DUI70.dll0.5.dr	Static PE information: section name: .cvjb
Source: DUI70.dll0.5.dr	Static PE information: section name: .tlmkv
Source: DUI70.dll0.5.dr	Static PE information: section name: .wucsxe
Source: DUI70.dll0.5.dr	Static PE information: section name: .wnx
Source: DUI70.dll0.5.dr	Static PE information: section name: .weqy
Source: DUI70.dll0.5.dr	Static PE information: section name: .yby
Source: DUI70.dll0.5.dr	Static PE information: section name: .ormx
Source: DUI70.dll0.5.dr	Static PE information: section name: .dhclu
Source: DUI70.dll0.5.dr	Static PE information: section name: .xmiul
Source: DUI70.dll0.5.dr	Static PE information: section name: .tlwcxe
Source: DUI70.dll0.5.dr	Static PE information: section name: .get
Source: DUI70.dll0.5.dr	Static PE information: section name: .hzrd
Source: DUI70.dll0.5.dr	Static PE information: section name: .gfrpb
Source: DUI70.dll0.5.dr	Static PE information: section name: .ymlijr
Source: DUI70.dll0.5.dr	Static PE information: section name: .tntrb
Source: DUI70.dll0.5.dr	Static PE information: section name: .rmvhl
Source: DUI70.dll0.5.dr	Static PE information: section name: .ukcyi
Source: DUI70.dll0.5.dr	Static PE information: section name: .knmra
Source: DUI70.dll0.5.dr	Static PE information: section name: .wtn
Source: DUI70.dll0.5.dr	Static PE information: section name: .kjnw
Source: DUI70.dll0.5.dr	Static PE information: section name: .okpgp
Source: DUI70.dll0.5.dr	Static PE information: section name: .oxbitk
Source: DUI70.dll0.5.dr	Static PE information: section name: .dplkzo
Source: DUI70.dll0.5.dr	Static PE information: section name: .psnue
Source: DUI70.dll0.5.dr	Static PE information: section name: .lida
Source: DUI70.dll0.5.dr	Static PE information: section name: .arovjd
Source: DUI70.dll0.5.dr	Static PE information: section name: .xsnm
Source: DUI70.dll0.5.dr	Static PE information: section name: .jxxke
Source: DUI70.dll1.5.dr	Static PE information: section name: .qkm
Source: DUI70.dll1.5.dr	Static PE information: section name: .cvjb
Source: DUI70.dll1.5.dr	Static PE information: section name: .tlmkv
Source: DUI70.dll1.5.dr	Static PE information: section name: .wucsxe
Source: DUI70.dll1.5.dr	Static PE information: section name: .wnx
Source: DUI70.dll1.5.dr	Static PE information: section name: .weqy
Source: DUI70.dll1.5.dr	Static PE information: section name: .yby
Source: DUI70.dll1.5.dr	Static PE information: section name: .ormx
Source: DUI70.dll1.5.dr	Static PE information: section name: .dhclu
Source: DUI70.dll1.5.dr	Static PE information: section name: .xmiul
Source: DUI70.dll1.5.dr	Static PE information: section name: .tlwcxe
Source: DUI70.dll1.5.dr	Static PE information: section name: .get
Source: DUI70.dll1.5.dr	Static PE information: section name: .hzrd
Source: DUI70.dll1.5.dr	Static PE information: section name: .gfrpb
Source: DUI70.dll1.5.dr	Static PE information: section name: .ymlijr
Source: DUI70.dll1.5.dr	Static PE information: section name: .tntrb
Source: DUI70.dll1.5.dr	Static PE information: section name: .rmvhl
Source: DUI70.dll1.5.dr	Static PE information: section name: .ukcyi
Source: DUI70.dll1.5.dr	Static PE information: section name: .knmra
Source: DUI70.dll1.5.dr	Static PE information: section name: .wtn
Source: DUI70.dll1.5.dr	Static PE information: section name: .kjnw
Source: DUI70.dll1.5.dr	Static PE information: section name: .okpgp
Source: DUI70.dll1.5.dr	Static PE information: section name: .oxbitk
Source: DUI70.dll1.5.dr	Static PE information: section name: .dplkzo
Source: DUI70.dll1.5.dr	Static PE information: section name: .psnue
Source: DUI70.dll1.5.dr	Static PE information: section name: .lida
Source: DUI70.dll1.5.dr	Static PE information: section name: .arovjd
Source: DUI70.dll1.5.dr	Static PE information: section name: .xsnm
Source: DUI70.dll1.5.dr	Static PE information: section name: .ddia
Source: SYSDM.CPL.5.dr	Static PE information: section name: .qkm
Source: SYSDM.CPL.5.dr	Static PE information: section name: .cvjb
Source: SYSDM.CPL.5.dr	Static PE information: section name: .tlmkv
Source: SYSDM.CPL.5.dr	Static PE information: section name: .wucsxe
Source: SYSDM.CPL.5.dr	Static PE information: section name: .wnx
Source: SYSDM.CPL.5.dr	Static PE information: section name: .weqy
Source: SYSDM.CPL.5.dr	Static PE information: section name: .yby
Source: SYSDM.CPL.5.dr	Static PE information: section name: .ormx
Source: SYSDM.CPL.5.dr	Static PE information: section name: .dhclu
Source: SYSDM.CPL.5.dr	Static PE information: section name: .xmiul
Source: SYSDM.CPL.5.dr	Static PE information: section name: .tlwcxe
Source: SYSDM.CPL.5.dr	Static PE information: section name: .get
Source: SYSDM.CPL.5.dr	Static PE information: section name: .hzrd
Source: SYSDM.CPL.5.dr	Static PE information: section name: .gfrpb
Source: SYSDM.CPL.5.dr	Static PE information: section name: .ymlijr
Source: SYSDM.CPL.5.dr	Static PE information: section name: .tntrb
Source: SYSDM.CPL.5.dr	Static PE information: section name: .rmvhl
Source: SYSDM.CPL.5.dr	Static PE information: section name: .ukcyi
Source: SYSDM.CPL.5.dr	Static PE information: section name: .knmra
Source: SYSDM.CPL.5.dr	Static PE information: section name: .wtn
Source: SYSDM.CPL.5.dr	Static PE information: section name: .kjnw
Source: SYSDM.CPL.5.dr	Static PE information: section name: .okpgp
Source: SYSDM.CPL.5.dr	Static PE information: section name: .oxbitk
Source: SYSDM.CPL.5.dr	Static PE information: section name: .dplkzo
Source: SYSDM.CPL.5.dr	Static PE information: section name: .psnue
Source: SYSDM.CPL.5.dr	Static PE information: section name: .lida
Source: SYSDM.CPL.5.dr	Static PE information: section name: .arovjd
Source: SYSDM.CPL.5.dr	Static PE information: section name: .xsnm
Source: SYSDM.CPL.5.dr	Static PE information: section name: .cav
Source: dwmapi.dll.5.dr	Static PE information: section name: .qkm
Source: dwmapi.dll.5.dr	Static PE information: section name: .cvjb
Source: dwmapi.dll.5.dr	Static PE information: section name: .tlmkv
Source: dwmapi.dll.5.dr	Static PE information: section name: .wucsxe
Source: dwmapi.dll.5.dr	Static PE information: section name: .wnx
Source: dwmapi.dll.5.dr	Static PE information: section name: .weqy
Source: dwmapi.dll.5.dr	Static PE information: section name: .yby
Source: dwmapi.dll.5.dr	Static PE information: section name: .ormx
Source: dwmapi.dll.5.dr	Static PE information: section name: .dhclu
Source: dwmapi.dll.5.dr	Static PE information: section name: .xmiul
Source: dwmapi.dll.5.dr	Static PE information: section name: .tlwcxe
Source: dwmapi.dll.5.dr	Static PE information: section name: .get
Source: dwmapi.dll.5.dr	Static PE information: section name: .hzrd
Source: dwmapi.dll.5.dr	Static PE information: section name: .gfrpb
Source: dwmapi.dll.5.dr	Static PE information: section name: .ymlijr
Source: dwmapi.dll.5.dr	Static PE information: section name: .tntrb
Source: dwmapi.dll.5.dr	Static PE information: section name: .rmvhl
Source: dwmapi.dll.5.dr	Static PE information: section name: .ukcyi
Source: dwmapi.dll.5.dr	Static PE information: section name: .knmra
Source: dwmapi.dll.5.dr	Static PE information: section name: .wtn
Source: dwmapi.dll.5.dr	Static PE information: section name: .kjnw
Source: dwmapi.dll.5.dr	Static PE information: section name: .okpgp
Source: dwmapi.dll.5.dr	Static PE information: section name: .oxbitk
Source: dwmapi.dll.5.dr	Static PE information: section name: .dplkzo
Source: dwmapi.dll.5.dr	Static PE information: section name: .psnue
Source: dwmapi.dll.5.dr	Static PE information: section name: .lida
Source: dwmapi.dll.5.dr	Static PE information: section name: .arovjd
Source: dwmapi.dll.5.dr	Static PE information: section name: .xsnm
Source: dwmapi.dll.5.dr	Static PE information: section name: .ebzjsb
Source: dwmapi.dll0.5.dr	Static PE information: section name: .qkm
Source: dwmapi.dll0.5.dr	Static PE information: section name: .cvjb
Source: dwmapi.dll0.5.dr	Static PE information: section name: .tlmkv
Source: dwmapi.dll0.5.dr	Static PE information: section name: .wucsxe
Source: dwmapi.dll0.5.dr	Static PE information: section name: .wnx
Source: dwmapi.dll0.5.dr	Static PE information: section name: .weqy
Source: dwmapi.dll0.5.dr	Static PE information: section name: .yby
Source: dwmapi.dll0.5.dr	Static PE information: section name: .ormx
Source: dwmapi.dll0.5.dr	Static PE information: section name: .dhclu
Source: dwmapi.dll0.5.dr	Static PE information: section name: .xmiul
Source: dwmapi.dll0.5.dr	Static PE information: section name: .tlwcxe
Source: dwmapi.dll0.5.dr	Static PE information: section name: .get
Source: dwmapi.dll0.5.dr	Static PE information: section name: .hzrd
Source: dwmapi.dll0.5.dr	Static PE information: section name: .gfrpb
Source: dwmapi.dll0.5.dr	Static PE information: section name: .ymlijr
Source: dwmapi.dll0.5.dr	Static PE information: section name: .tntrb
Source: dwmapi.dll0.5.dr	Static PE information: section name: .rmvhl
Source: dwmapi.dll0.5.dr	Static PE information: section name: .ukcyi
Source: dwmapi.dll0.5.dr	Static PE information: section name: .knmra
Source: dwmapi.dll0.5.dr	Static PE information: section name: .wtn
Source: dwmapi.dll0.5.dr	Static PE information: section name: .kjnw
Source: dwmapi.dll0.5.dr	Static PE information: section name: .okpgp
Source: dwmapi.dll0.5.dr	Static PE information: section name: .oxbitk
Source: dwmapi.dll0.5.dr	Static PE information: section name: .dplkzo
Source: dwmapi.dll0.5.dr	Static PE information: section name: .psnue
Source: dwmapi.dll0.5.dr	Static PE information: section name: .lida
Source: dwmapi.dll0.5.dr	Static PE information: section name: .arovjd
Source: dwmapi.dll0.5.dr	Static PE information: section name: .xsnm
Source: dwmapi.dll0.5.dr	Static PE information: section name: .guwfpe
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .qkm
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .cvjb
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .tlmkv
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .wucsxe
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .wnx
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .weqy
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .yby
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .ormx
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .dhclu
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .xmiul
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .tlwcxe
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .get
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .hzrd
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .gfrpb
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .ymlijr
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .tntrb
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .rmvhl
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .ukcyi
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .knmra
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .wtn
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .kjnw
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .okpgp
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .oxbitk
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .dplkzo
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .psnue
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .lida
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .arovjd
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .xsnm
Source: WTSAPI32.dll.5.dr	Static PE information: section name: .ewk

Source: DUI70.dll0.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x1ba3da
Source: DUI70.dll.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x1c3a86
Source: WTSAPI32.dll.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x17e741
Source: HID.DLL.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x176730
Source: DUI70.dll1.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x1bcde0
Source: SYSDM.CPL.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x17267b
Source: SLC.dll.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x1765b4
Source: UxTheme.dll.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x17aa1e
Source: dwmapi.dll0.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x175795
Source: 2qTIaOLW2o.dll	Static PE information: real checksum: 0x7d786c40 should be: 0x17290a
Source: dwmapi.dll.5.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x171021

Source: SndVol.exe.5.dr

Static PE information: 0x6E534A77 [Sun Aug 27 01:25:11 2028 UTC]

Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\hbyq\SYSDM.CPL

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\y7FgRNmA\DUI70.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\xOu8\LockScreenContentServer.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\rPj\DUI70.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\N52IORg\rdpinit.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\cAlXLQGkN\UxTheme.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\ScS40sYu\GamePanel.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\xOu8\dwmapi.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\hbyq\SystemPropertiesPerformance.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\52smNq1W\SLC.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\hbyq\SYSDM.CPL	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\CsJaRZ\HID.DLL	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\famGrLP\dpapimig.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\ScS40sYu\dwmapi.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\y7FgRNmA\dpapimig.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\N52IORg\WTSAPI32.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\famGrLP\DUI70.dll	Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\kbiogkuS0

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\explorer.exe TID: 4460

Thread sleep count: 36 > 30

Jump to behavior

Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\famGrLP\dpapimig.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\y7FgRNmA\dpapimig.exe	Last function: Thread delayed

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\xOu8\LockScreenContentServer.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\N52IORg\rdpinit.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\ScS40sYu\GamePanel.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\N52IORg\WTSAPI32.dll	Jump to dropped file

Source: C:\Windows\System32\loaddll64.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000000014005C340 GetSystemInfo,

0_2_000000014005C340

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005D290 FindFirstFileExW,	0_2_000000014005D290
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B2466334 #620,#624,#6050,#1040,#1040,#4436,#1122,#1040,#624,#1259,#1040,#626,FindFirstFileW,#624,#1259,#1262,#1122,#1040,#1040,#1040,_wcsicmp,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,#624,#1259,#1040,FindFirstFileW,#622,#624,#624,#1259,#1259,#1040,#1040,#1040,#1040,#1040,FindNextFileW,FindClose,RemoveDirectoryW,#1040,#1040,#1040,#1040,	33_2_00007FF7B2466334
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B24672AC #624,FindFirstFileW,FindClose,#6050,_wcsicmp,#1040,#1463,_wcsicmp,#624,CreateFileW,GetFileSize,ReadFile,CloseHandle,#1040,CreateFileW,#6886,CloseHandle,#6886,_wcsicmp,#626,#624,#1040,#624,#1122,SetupIterateCabinetW,#1040,#626,#626,RegOpenKeyExW,RegGetValueW,#1126,RegCloseKey,#1040,#1040,#1040,RegOpenKeyExW,#624,#2975,RegSetValueExW,#1122,RegCloseKey,#1040,RegCloseKey,#620,#620,#628,#1042,#1040,#1040,#622,#1259,#1122,#1040,#1040,#1284,#2783,#1040,#1040,#1040,#1042,#1040,#1040,#1040,#1040,#1040,#1040,GetLastError,#626,#626,#4473,#4473,#1287,#1287,MessageBoxW,#1040,#1040,#1040,	33_2_00007FF7B24672AC
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B2465DE8 #626,#626,#1122,#624,#6050,#1040,#1040,#624,#1284,#1040,#1259,#1122,#1040,FindFirstFileW,#624,#1259,#1358,#1040,#1040,FindNextFileW,FindClose,#624,#1259,#1122,#1040,#1040,FindFirstFileW,#624,#1259,#1040,#1040,FindNextFileW,FindClose,#1040,#1040,	33_2_00007FF7B2465DE8

Source: explorer.exe, 00000005.00000000.286592202.000000000891C000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000005.00000000.286592202.000000000891C000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.245879634.00000000011B3000.00000004.00000020.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: explorer.exe, 00000005.00000000.286650607.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000005.00000000.248330423.00000000053C4000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000005.00000000.286650607.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002

Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe

Code function: 22_2_00007FF6153D21D0 GetCurrentThreadId,memset,IsDebuggerPresent,OutputDebugStringW,

22_2_00007FF6153D21D0

Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe

Code function: 22_2_00007FF6153D3288 WaitForSingleObjectEx,GetLastError,CloseHandle,SetLastError,GetLastError,CloseHandle,SetLastError,GetLastError,ReleaseMutex,SetLastError,GetProcessHeap,HeapFree,ReleaseMutex,

22_2_00007FF6153D3288

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000000140048AC0 LdrLoadDll,FindClose,

0_2_0000000140048AC0

Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153EEE40 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_00007FF6153EEE40
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153EF2E0 SetUnhandledExceptionFilter,	22_2_00007FF6153EF2E0
Source: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe	Code function: 24_2_00007FF6FB159094 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_00007FF6FB159094
Source: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe	Code function: 24_2_00007FF6FB159290 SetUnhandledExceptionFilter,	24_2_00007FF6FB159290
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56C09B4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF6A56C09B4
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Code function: 28_2_00007FF6A56C0740 SetUnhandledExceptionFilter,	28_2_00007FF6A56C0740
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B246D120 SetUnhandledExceptionFilter,	33_2_00007FF7B246D120
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: 33_2_00007FF7B246CE08 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	33_2_00007FF7B246CE08
Source: C:\Users\user\AppData\Local\famGrLP\dpapimig.exe	Code function: 35_2_00007FF6882C2BE0 SetUnhandledExceptionFilter,	35_2_00007FF6882C2BE0
Source: C:\Users\user\AppData\Local\famGrLP\dpapimig.exe	Code function: 35_2_00007FF6882C29D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	35_2_00007FF6882C29D0
Source: C:\Users\user\AppData\Local\y7FgRNmA\dpapimig.exe	Code function: 38_2_00007FF6751029D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	38_2_00007FF6751029D0
Source: C:\Users\user\AppData\Local\y7FgRNmA\dpapimig.exe	Code function: 38_2_00007FF675102BE0 SetUnhandledExceptionFilter,	38_2_00007FF675102BE0
Source: C:\Users\user\AppData\Local\hbyq\SystemPropertiesPerformance.exe	Code function: 40_2_00007FF6052516E4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	40_2_00007FF6052516E4
Source: C:\Users\user\AppData\Local\hbyq\SystemPropertiesPerformance.exe	Code function: 40_2_00007FF605251460 SetUnhandledExceptionFilter,	40_2_00007FF605251460

HIPS / PFW / Operating System Protection Evasion:

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: UxTheme.dll.5.dr

Jump to dropped file

Changes memory attributes in foreign processes to executable or writable

Show sources

Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFA9B8EEFE0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFA9B8EE000 protect: page execute read	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFA9B312A20 protect: page execute and read and write	Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Windows\System32\rundll32.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Contains functionality to automate explorer (e.g. start an application)

Show sources

Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153DA5C8 GetDC,GetDeviceCaps,ReleaseDC,LoadIconW,SendMessageW,GetWindowBand,FindWindowW,GetWindowBand,FindWindowW,SendMessageTimeoutW,GetWindowLongW,SetWindowLongW,SetForegroundWindow,IsThemeActive,DwmIsCompositionEnabled,GetWindowRect,GetClientRect,EnterCriticalSection,GetWindowRect,LeaveCriticalSection,SetWindowPos,LeaveCriticalSection,memset,Shell_NotifyIconGetRect,GetWindowRect,DwmIsCompositionEnabled,Shell_NotifyIconGetRect,InflateRect,CalculatePopupWindowPosition,SetWindowPos,InvalidateRect,GetClientRect,EnterCriticalSection,SetWindowPos,GetDlgItem,SetFocus,ShowWindow,LeaveCriticalSection,SetTimer,NotifyWinEvent,		22_2_00007FF6153DA5C8
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: 22_2_00007FF6153DA5C8 GetDC,GetDeviceCaps,ReleaseDC,LoadIconW,SendMessageW,GetWindowBand,FindWindowW,GetWindowBand,FindWindowW,SendMessageTimeoutW,GetWindowLongW,SetWindowLongW,SetForegroundWindow,IsThemeActive,DwmIsCompositionEnabled,GetWindowRect,GetClientRect,EnterCriticalSection,GetWindowRect,LeaveCriticalSection,SetWindowPos,LeaveCriticalSection,memset,Shell_NotifyIconGetRect,GetWindowRect,DwmIsCompositionEnabled,Shell_NotifyIconGetRect,InflateRect,CalculatePopupWindowPosition,SetWindowPos,InvalidateRect,GetClientRect,EnterCriticalSection,SetWindowPos,GetDlgItem,SetFocus,ShowWindow,LeaveCriticalSection,SetTimer,NotifyWinEvent,		22_2_00007FF6153DA5C8

Uses Atom Bombing / ProGate to inject into other processes

Show sources

Source: C:\Windows\System32\rundll32.exe

Atom created: 405553565741544156488D6C24D14881EC98 0x00000000 inc eax 0x00000001 push ebp 0x00000002 push ebx 0x00000003 push esi 0x00000004 push edi 0x00000005 inc ecx 0x00000006 push esp 0x00000007 inc ecx 0x00000008 push esi 0x00000009 dec eax 0x0000000a lea ebp, dword ptr [esp-2Fh] 0x0000000e dec eax 0x0000000f sub esp, 00000098h

Jump to behavior

Source: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe

Code function: 24_2_00007FF6FB1515D0 GetModuleFileNameW,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,ShellExecuteW,GetProcessHeap,HeapFree,LocalFree,

24_2_00007FF6FB1515D0

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\2qTIaOLW2o.dll',#1

Jump to behavior

Source: explorer.exe, 00000005.00000000.293621445.0000000001640000.00000002.00020000.sdmp, SndVol.exe	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.293621445.0000000001640000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.293621445.0000000001640000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000005.00000000.245752691.0000000001128000.00000004.00000020.sdmp	Binary or memory string: ProgmanOMEa
Source: SndVol.exe, 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp, SndVol.exe.5.dr	Binary or memory string: Software\Microsoft\Multimedia\Audio\SndVolSndVolPreferencesMaskSndVolSelectedDevicesShell_TrayWnd
Source: rdpinit.exe.5.dr	Binary or memory string: Initialize failedDwmpGetColorizationParameters failedDwmpSetColorizationParametersCRdpTrayTaskbarCreatedShell_TrayWndRdptrayTSCreateAppbarTrayFN failedTSCreateShellNotifyTrayFN failedTSCreateTaskbarTrayFn failedTSCreateWindowCloakingTracker failedFailed g_RailOrderEncoder.InitializeFailed g_RailOrderEncoder.StartUpdating max icon size for the tray icon failed.m_spAppBarTrayFnm_spWindowCloakingTrackerRemoveWindow failedRemoveDestroyedWindows failed~/
Source: explorer.exe, 00000005.00000000.293621445.0000000001640000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000005.00000000.293621445.0000000001640000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\famGrLP\dpapimig.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\famGrLP\dpapimig.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\y7FgRNmA\dpapimig.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\y7FgRNmA\dpapimig.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\hbyq\SystemPropertiesPerformance.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\hbyq\SystemPropertiesPerformance.exe	Queries volume information: unknown VolumeInformation

Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe	Code function: GetUserPreferredUILanguages,malloc,GetUserPreferredUILanguages,GetLocaleInfoEx,free,	22_2_00007FF6153E9EF4
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,memset,#626,#626,#2846,#2846,GetNumberFormatW,#624,#1040,#1040,	33_2_00007FF7B2459CEC
Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	Code function: #624,#1463,#6708,#626,#2846,#1122,#2846,#1095,#2629,GetDateFormatW,#1126,#2841,#1122,#4473,#4473,#1122,wcstoul,GetLocaleInfoW,#4473,#4473,#4473,#4473,#4473,#626,#1122,memset,StrFormatByteSizeEx,#1126,#2846,#1122,#1040,#1264,#1284,#1264,#1284,#1264,#1284,#1264,#1284,#1264,#1284,#1040,#1264,#1262,#1259,#1262,#1284,#1040,#1040,#1040,#1040,#1040,#1122,#4523,#4521,#6708,#1095,#2629,GetDateFormatW,#1126,GetTimeFormatW,#624,#624,#1259,#1284,#1040,#1040,#1040,#2841,#1122,#1040,#1122,#1040,#1122,#624,#2783,#6216,#2846,#1040,#1040,	33_2_00007FF7B2459E90

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe

Code function: 22_2_00007FF6153EF470 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

22_2_00007FF6153EF470

Source: C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe

Code function: 33_2_00007FF7B24589B8 #626,#624,GetVersionExW,#624,#620,

33_2_00007FF7B24589B8

Source: C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe

Code function: 28_2_00007FF6A56AC8A0 TlsGetValue,TlsSetValue,?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z,?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z,?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z,?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z,?CreateBool@Value@DirectUI@@SAPEAV12@_N@Z,?AccessibleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ,?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z,?_ZeroRelease@Value@DirectUI@@AEAAXXZ,StrToID,?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z,?GetClassInfoPtr@ModernProgressBar@DirectUI@@SAPEAUIClassInfo@2@XZ,?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ,TlsGetValue,TlsSetValue,

28_2_00007FF6A56AC8A0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Exploitation for Client Execution1	Create Account1	Exploitation for Privilege Escalation1	Masquerading11	Input Capture11	System Time Discovery1	Remote Services	Input Capture11	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Registry Run Keys / Startup Folder1	Process Injection312	Virtualization/Sandbox Evasion1	LSASS Memory	Security Software Discovery21	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	DLL Side-Loading1	Registry Run Keys / Startup Folder1	Process Injection312	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Clipboard Data2	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	DLL Side-Loading1	Deobfuscate/Decode Files or Information1	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Hidden Window1	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information3	Cached Domain Credentials	System Information Discovery35	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Rundll321	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing2	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Timestomp1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	DLL Side-Loading1	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
2qTIaOLW2o.dll	68%	Virustotal		Browse
2qTIaOLW2o.dll	76%	ReversingLabs	Win64.Infostealer.Dridex
2qTIaOLW2o.dll	100%	Avira	HEUR/AGEN.1114452

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\ScS40sYu\dwmapi.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\cAlXLQGkN\UxTheme.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\CsJaRZ\HID.DLL	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\famGrLP\DUI70.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\famGrLP\DUI70.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\ScS40sYu\dwmapi.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\N52IORg\WTSAPI32.dll	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\52smNq1W\SLC.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\hbyq\SYSDM.CPL	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\famGrLP\DUI70.dll	100%	Avira	HEUR/AGEN.1114452
C:\Users\user\AppData\Local\ScS40sYu\dwmapi.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\cAlXLQGkN\UxTheme.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\CsJaRZ\HID.DLL	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\famGrLP\DUI70.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\famGrLP\DUI70.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\ScS40sYu\dwmapi.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\N52IORg\WTSAPI32.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\52smNq1W\SLC.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\hbyq\SYSDM.CPL	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\famGrLP\DUI70.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\N52IORg\rdpinit.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\N52IORg\rdpinit.exe	2%	ReversingLabs
C:\Users\user\AppData\Local\ScS40sYu\GamePanel.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\ScS40sYu\GamePanel.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
38.2.dpapimig.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
24.2.tabcal.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.2.dpapimig.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.SndVol.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
28.2.ProximityUxHost.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.loaddll64.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
40.2.SystemPropertiesPerformance.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
8.2.rundll32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
33.2.msinfo32.exe.140000000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://schemas.micro	0%	Avira URL Cloud	safe
https://www.xboxlive.comMBI_SSLhttps://profile.xboxlive.com/users/me/profile/settings?settings=GameD	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://mixer.com/api/v1/chats/%.0fhttps://mixer.com/api/v1/users/currentBEAM_IMAGEGamesGuide::BeamC	GamePanel.exe.5.dr	false		high
https://MediaData.XboxLive.com/broadcasts/Augmenthttps://MediaData.XboxLive.com/screenshots/Augmenth	GamePanel.exe.5.dr	false		high
https://aka.ms/wk9ocd	GamePanel.exe.5.dr	false		high
http://schemas.micro	SndVol.exe, 00000015.00000002.327014978.00000242A3690000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.xboxlive.comMBI_SSLhttps://profile.xboxlive.com/users/me/profile/settings?settings=GameD	GamePanel.exe.5.dr	false	Avira URL Cloud: safe	low
https://mixer.com/_latest/assets/emoticons/%ls.pngtitleIdaumIdkglIdprocessNamenametypeIdmultimedia	GamePanel.exe.5.dr	false		high
https://mixer.com/api/v1/broadcasts/current	GamePanel.exe.5.dr	false		high
https://aka.ms/w5ryqnhttps://aka.ms/imfx4kQUITTING	GamePanel.exe.5.dr	false		high
https://mixer.com/%wsWindows.System.Launcher	GamePanel.exe.5.dr	false		high
https://mixer.com/api/v1/types/lookup%wshttps://mixer.com/api/v1/channels/%wshttps://mixer.com/api/v	GamePanel.exe.5.dr	false		high

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	492663
Start date:	28.09.2021
Start time:	22:15:13
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	2qTIaOLW2o (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@45/21@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 22.4% (good quality ratio 12.7%) Quality average: 41.3% Quality standard deviation: 42.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.35.236.56, 20.50.102.62, 40.112.88.60, 80.67.82.211, 80.67.82.235, 20.82.209.183, 20.54.110.249 Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe	HGFrrT5cBg.dll	Get hash	malicious	Browse
	wKfbxvfLA7.dll	Get hash	malicious	Browse
	YZz3lg22hZ.dll	Get hash	malicious	Browse
	gSrnekbzWz.dll	Get hash	malicious	Browse
	CKkP707sai.dll	Get hash	malicious	Browse
	D5v1a7JiAH.dll	Get hash	malicious	Browse
	rJyP5pxSI7.dll	Get hash	malicious	Browse
	88BSEM1IkN.dll	Get hash	malicious	Browse
	vZj1JjJAy2.dll	Get hash	malicious	Browse
	eQXkEkSQhL.dll	Get hash	malicious	Browse
	YO7iRsM7tG.dll	Get hash	malicious	Browse
	l7ytx2QXnx.dll	Get hash	malicious	Browse
	QWgClRWFNy.dll	Get hash	malicious	Browse
	470DeIOhtD.dll	Get hash	malicious	Browse
	Us23xitkTH.dll	Get hash	malicious	Browse
	Zb6sV9ey4t.dll	Get hash	malicious	Browse
	I8r3L9j0OV.dll	Get hash	malicious	Browse
	t7jfSji774.dll	Get hash	malicious	Browse
	oCyvFsS0pj.dll	Get hash	malicious	Browse
	Hc3Lunec1q.dll	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\52smNq1W\SLC.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1507328
Entropy (8bit):	4.714933571001978
Encrypted:	false
SSDEEP:	12288:9VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1/1:kfP7fWsK5z9A+WGAW+V5SB6Ct4bnb/1
MD5:	931F07A0FF47CF3564D15E608659ED58
SHA1:	1015C7CCD1235FE1F983EE7644FDE582389FB000
SHA-256:	588D87F044D8503B5467BBA8C3007164F14BAE891DE3D4D59A221991CB1F4AFE
SHA-512:	25BEFE8EF97D40D2260C362A8A0E944B2D49A4AD5EFDE8AF8C816049865252BCB7FF6AB26DF8C2A06C954324678B50CEF638E28FB72A1B26A3F47CF3B081CAAB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.#..DN^.........." ................p..........@....................................@lx}..b.............................................3....c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	370176
Entropy (8bit):	6.448503897594857
Encrypted:	false
SSDEEP:	6144:Uca2EiZg+uTUbSFWjSJiIOKZXcmg3GexhxiZEOHHrpm1XUZLxEZEOHHrpm1XUZLx:UB2PsUbSFWWAkZXcmkVx+tLpm1EwtLpr
MD5:	C471C6B06F47EA1C66E5FAA8DFCEF108
SHA1:	F8672A2B3B32956CBC948A954CEF236581045B78
SHA-256:	E2255751C1CF58596C8FE70C3093E099F8D71ED89580CFD0156FFCF0FED32861
SHA-512:	F7A2A31910CD4694B58FFCED83A2CCF633B5594859F178AFB9F67C02E3E664DA72701E7E45AA5590C4F1E1C99C82B665F0C0B80401506F0DFA49B61A8EEBD6BA
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: HGFrrT5cBg.dll, Detection: malicious, Browse Filename: wKfbxvfLA7.dll, Detection: malicious, Browse Filename: YZz3lg22hZ.dll, Detection: malicious, Browse Filename: gSrnekbzWz.dll, Detection: malicious, Browse Filename: CKkP707sai.dll, Detection: malicious, Browse Filename: D5v1a7JiAH.dll, Detection: malicious, Browse Filename: rJyP5pxSI7.dll, Detection: malicious, Browse Filename: 88BSEM1IkN.dll, Detection: malicious, Browse Filename: vZj1JjJAy2.dll, Detection: malicious, Browse Filename: eQXkEkSQhL.dll, Detection: malicious, Browse Filename: YO7iRsM7tG.dll, Detection: malicious, Browse Filename: l7ytx2QXnx.dll, Detection: malicious, Browse Filename: QWgClRWFNy.dll, Detection: malicious, Browse Filename: 470DeIOhtD.dll, Detection: malicious, Browse Filename: Us23xitkTH.dll, Detection: malicious, Browse Filename: Zb6sV9ey4t.dll, Detection: malicious, Browse Filename: I8r3L9j0OV.dll, Detection: malicious, Browse Filename: t7jfSji774.dll, Detection: malicious, Browse Filename: oCyvFsS0pj.dll, Detection: malicious, Browse Filename: Hc3Lunec1q.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|....y...y...y..yz...y..y}...y..y\|...y..yx...y...x...y..yp...y..y....y..y{...y.Rich..y.................PE..d....a............"............................@.............................0............`.......... ......................................$...h.......xJ......(............ .. ...P...T...........................P...............P... ............................text............................... ..`.rdata..H*.......,..................@..@.data....k...@.......(..............@....pdata..(............D..............@..@.rsrc...xJ.......L...V..............@..@.reloc.. .... ......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\CsJaRZ\HID.DLL Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1507328
Entropy (8bit):	4.715367229885423
Encrypted:	false
SSDEEP:	12288:EVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:hfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	1B5413AD9E40CC700FF62DE89BAF56BE
SHA1:	1D7D75FC0645F2FD05DAF0FF475169DF707E5CCF
SHA-256:	5CA62F2EF0BF9E37DAF51EAD56EC7BCB3BA7F2B5CB55AD2023A2040C40C00C7A
SHA-512:	773133FDCFF1D9746B019B52125F501ADAF86DF362829F91A49E80C2B51C795D7793E35C9CCC766B662CF15411CCD5BE34071304BE4458C5D33ABF0F9EB789B9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.#..DN^.........." ................p..........@....................................@lx}..b..................................................c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	5.705817452511626
Encrypted:	false
SSDEEP:	1536:Q77RYSqLmKbndnBRdv2RWUUTtj11VM0bJDrdfW2jbJK:QuxLmKbndDdv2WUczVMKrdfZbs
MD5:	F04F239BA5FED275E652372222D1BE00
SHA1:	883C7915ADD2B47D1012E52321D670A4A29ABB53
SHA-256:	CE81E5BFF4C0A646EFD86791DB938A7F5E148666F518990B156FE208F8454423
SHA-512:	61B80BC6E68057C425C624DC4FC8A551F60F6E4DA60A7F5A6D6520FE92E0B61D1B63B16DF70A5019C3F0AFFE8064CD072BBADC3C69E1DB8833E1E3ABA9C45529
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d.. ... ... ...).`.>...O..."...O...2...O...&...O...7... ...$...O...)...O...!...O...!...Rich ...................PE..d...r.T,.........."............................@....................................&.....`.......... ...............................................0..@r......................\|...p...T...................................................,........................text...J........................... ..`.rdata..f4.......6..................@..@.data....!..........................@....pdata..............................@..@.didat..P.... ......................@....rsrc...@r...0...t..................@..@.reloc..\|............B..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\N52IORg\WTSAPI32.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1507328
Entropy (8bit):	4.719488777601788
Encrypted:	false
SSDEEP:	12288:JVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:ofP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	977F0FAC6FBFF743D7F33651AAE2FAE7
SHA1:	B1011C13AC6088B70FB838D62F360894871CCCF1
SHA-256:	2A9205980480DFA5839343742120B4AFE90EA0C23BD6BEB95F62AADDF81D0E5C
SHA-512:	798865671A7F428DFF7D65D969E8AD2AD591180C1EA599943FA43F6B3FBCCC9EA0507F4EBC20643FFA60649417E5DEFED446024EC810B1649624C684D4C3ABEE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.#..DN^.........." ................p..........@....................................@lx}..b..................................................c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\N52IORg\rdpinit.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	327168
Entropy (8bit):	6.414070673036673
Encrypted:	false
SSDEEP:	6144:fOzsB7eGjsO+VxyQ/qY4gCJkxkVPXqdzVxNwK3S3drxhUS4eMZfCZc/o:fOzsB7eGjb+VxynJkxkZ6dzV63drxhlF
MD5:	EF7C9CF6EA5B8B9C5C8320990714C35D
SHA1:	9CBD44DE4761F9383F2E0352035D52B86ECE80C2
SHA-256:	0FD9B6C366E042ED83BFC53C5EA1AAF43F13F53D97F220B5571681BB766C33FA
SHA-512:	C2F5E902DF725BC05F03052042767635689A35226CA1C3436ADF4835C57666B3E815FD386B80517734AC3B71F2FB15E48CE2F6739D669B5F68F4A8989713E8FC
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s.....S...S...S.j.S...S.v.R...S.v.R...S.v.R...S.v.R...S...S...S.v.R...S.vmS...S.v.R...SRich...S................PE..d...q............"..........f...... ..........@.............................p......+................ ..........................................@....@..........d ...........`..x.......T............................................................................text...<........................... ..`.imrsiv..................................rdata..............................@..@.data....:..........................@....pdata..d ......."..................@..@.rsrc........@......................@..@.reloc..x....`......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\ScS40sYu\GamePanel.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1292288
Entropy (8bit):	6.159394598062476
Encrypted:	false
SSDEEP:	24576:tg6uRV8QrFa8Zdntp/LEz2INhgITVXTvlHQroF:tgJVbFaqtpDEznyQVjvZQroF
MD5:	4EF330EFAE954723B1F2800C15FDA7EB
SHA1:	3E152C0B10E107926D6A213C882C161D80B836C9
SHA-256:	0494166D4AE6BB7925E4F57BB6DFAC629C95AE9E03DFC925F8232893236BD982
SHA-512:	C122CD7A245EF6A6A7B7DECAB6500BDC11E4C57B8E35F8462CC0615E44E54071E6BF79B69BB8519470ACBAF0D2E62ABC45C38CBF0606261792EDB4A84790EC61
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.ur.`.!.`.!.`.!...!P`.!... .`.!... .`.!... 4`.!... 9`.!.`.!de.!... .`.!...!.`.!...!.`.!... .`.!Rich.`.!........PE..d................"......H..........0..........@.............................@....................... ...................................................u......`................:..p...T....................@..(...pp..............8@..H... ...@....................text....F.......H.................. ..`.imrsiv......`...........................rdata......p.......L..............@..@.data...............................@....pdata..`............~..............@..@.didat.......p......................@....rsrc....u.......v..................@..@.reloc...:.......<...\|..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\ScS40sYu\dwmapi.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1507328
Entropy (8bit):	4.7172480760765225
Encrypted:	false
SSDEEP:	12288:QVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:VfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	F0C1C0EFA6B7AA1310B6396A0C7792B8
SHA1:	70EBE0CDC6B1B58E63DEC768585E43A61CC04104
SHA-256:	FBD29EC92724DA370034AE036C4BA84B1E5950E6610195E1F67A2F79F939D3F8
SHA-512:	06F5B9FF6300097D4D4BE0FD38159FDBA325A9910856925851EF7ADE5ED2FC3F2CA52995A1FC48C8C345ABEDF59536DC11E8B24D41DE41BEE05FE7AA8C7D9FE9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.#..DN^.........." ................p..........@....................................@lx}..b.............................................&....c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	259904
Entropy (8bit):	5.955701055747905
Encrypted:	false
SSDEEP:	3072:UfYIZJbRydnidilSnGvLqeD358rwW39nuyHjVozZcxSHfcBL1ljbEyB7HbIa+:Uf9JonidFnqLV358rNnJqcRcy10/
MD5:	CDD7C7DF2D0859AC3F4088423D11BD08
SHA1:	128789A2EA904F684B5DF2384BA6EEF4EB60FB8E
SHA-256:	D98DB8339EB1B93A7345EECAC2B7290FA7156E3E12B7632D876BD0FD1F31EC66
SHA-512:	A093BF3C40C880A80164F2CAA87DF76DCD854375C5216D761E60F3770DFA04F4B02EC0CA6313C32413AC99A3EBDC081CF915A7B468EE3CED80F9B1ECF4B49804
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<.BL]..L]..L]..E%...]..#9..O]..#9..U]..#9..F]..#9..W]..L]...\..#9..o]..#9k.M]..#9..M]..RichL]..........................PE..d...wJSn.........."............................@.............................@....................... .........................................p.... ..@...............@+...0.......U..T...................p&..(...p%...............&......P........................text............................... ..`.imrsiv..................................rdata....... ......................@..@.data...............................@....pdata..............................@..@.didat..............................@....rsrc...@.... ......................@..@.reloc.......0......................@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\cAlXLQGkN\UxTheme.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1507328
Entropy (8bit):	4.722422114873919
Encrypted:	false
SSDEEP:	12288:7VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:afP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	68DE2990C8FE0CE0A8E8D7FC6D5476F7
SHA1:	DA109B2BD225C4A8684EC6180597721B3A59D218
SHA-256:	660AB33F14DF750EFCB35D432C96636CDDC072934C49E66BFE5414BEDBD4FF3C
SHA-512:	7E69341AA3D59EBF67E0C83858BE75BE4BB0498A5B2CFF6CB227F30430D6DED9402DC649D7246FA440DE97691352B9E12839825343B85ED4483B13F885BF9533
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.#..DN^.........." ................p..........@....................................@lx}..b..................................................c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\famGrLP\DUI70.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1789952
Entropy (8bit):	5.183242701242126
Encrypted:	false
SSDEEP:	12288:rVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1Zy:qfP7fWsK5z9A+WGAW+V5SB6Ct4bnbZ
MD5:	C7F2912674EC4F16E8BB5950E583BD8C
SHA1:	F6E8E4206F69AC4E7D6CE7D5CA6BEF04A14AEE98
SHA-256:	98A46C671364D336B6EED344EF0ECBD4E4D534E2754F8EA281305D66B87F7773
SHA-512:	291A48B6F3BA34F0F4DCB8E040C94C3D9341FBCF5DBEA46C46B6DBC1917F8B7258C650DA579DDAA01645988A68BED29ED8DFB63521A0544C3182174D77F7E799
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.#..DN^.........." .........0......p..........@.............................P......@lx}..b.............................................dQ...c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\famGrLP\dpapimig.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	5.908989367752963
Encrypted:	false
SSDEEP:	1536:CzbG9gXEurcYIZh800l3uU1HIED1fCbWpygzU:obezur2hrSJj16bE
MD5:	EE7DB7B615B48D8F9F08FAE70CAF46D7
SHA1:	FB5021297FDF24000ADD478164EEC8048871B335
SHA-256:	7999B821F8A673B0528C8F5F72A68A61393BEF78785FC1B4A0B3938D8CDD14B8
SHA-512:	F2292577166A330409813215DD49F2A276739AB51621316FBD418A377F4FD2476E50720A88F3069D16146E5C57DF47B21D800089EE48B28158BCBCFE3B6776AB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............nx..nx..nx......nx...{..nx...\|..nx...}..nx...y..nx..ny..nx...q..nx......nx...z..nx.Rich.nx.................PE..d...Y............."......"..........@'.........@....................................+.....`.......... .......................................L..........@....................p..P....H..T............................@...............A...............................text.... .......".................. ..`.rdata... ...@..."...&..............@..@.data........p.......H..............@....pdata...............J..............@..@.rsrc...@............L..............@..@.reloc..P....p.......*..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\hbyq\SYSDM.CPL Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1507328
Entropy (8bit):	4.710638800025406
Encrypted:	false
SSDEEP:	12288:8VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:JfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	68DF43064563A92810B1367FF511759D
SHA1:	D09AF560BA699A11552E885A11D855B6233D194D
SHA-256:	365C3153CB477FF992F9E21BF6CB1F6A4C9C61E8219980B4B311C6B61D639345
SHA-512:	BFC3FD937C7D1F16236B88F24A4F5C915DB82FCBBC2C7B941D96A4E32F7156E5A1AABC81AEBE5B9317558A3DE7855EEC18DA5E4A5F776B665886D45E795598E5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.#..DN^.........." ................p..........@....................................@lx}..b..................................................c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\hbyq\SystemPropertiesPerformance.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.071848641739436
Encrypted:	false
SSDEEP:	1536:5MVEZnXtREC/rMcgEPJV+G57ThjEC0kzJP+V5J9:3XzECTMpuDhjRVJGf
MD5:	F325976CDC0F7E9C680B51B35D24D23A
SHA1:	8BA00280B451378802DD2A06BB139B8BEA78C90C
SHA-256:	E24A61B15FD191DDC8A2CA82E22A759609E6099A832ADE0B5C0C6E0F1ABB05FE
SHA-512:	9D65A154758B5C38C09AACA1BB51E53FE6E8DEA374EAD88AEA33AB41525B3BB180211D6F6C93CA112197F7455842228960699DF471F47EE83DBC6CA59A5166EC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.v..c...c...c.......c..n....c..n....c..n....c..n....c...c.."c..n....c..n...c..n....c..Rich.c..................PE..d...0............."..........>.................@.....................................s....`.......... ......................................<&.......P..P'...@.................. ....#..T............................ ...............!..H............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc...P'...P...(..................@..@.reloc.. ............F..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\rPj\DUI70.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1789952
Entropy (8bit):	5.18332372992189
Encrypted:	false
SSDEEP:	12288:IVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1Ry:dfP7fWsK5z9A+WGAW+V5SB6Ct4bnbR
MD5:	10B3C5DF9285A3ECF64198911AC01974
SHA1:	D4A99A0992F267974BF4463A35990DFAE443BA36
SHA-256:	94670AEE3C795FF8FC8D0829B626D2D02B516259F875CF6C7CA1E6B709EA99A1
SHA-512:	53DC073092979D1E2D3F7F89AD0A4A6DF1285A28A74DEA66AE7EEF9D398AA82E6FF486A2CD514DCFD5314177F777C91C10A1A94963B1C0B707919DBFE8867B72
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.#..DN^.........." .........0......p..........@.............................P......@lx}..b.............................................dQ...c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	264480
Entropy (8bit):	6.478365286411354
Encrypted:	false
SSDEEP:	6144:xSt+s2GFGbqEuzhJONjx9UVuCuHpwqr/vt9r+ULJBaBpcIFz:xStzFGbGhoPgMHpwqrHthUB6IF
MD5:	E7F0E9B3779E54CD271959C600A2A531
SHA1:	8006E2D1AA91798E48D8BFDE1EBF94A2D6BA6C0A
SHA-256:	155CE33E0E145314FE9D8911BE69B8CBBD2AC09B7B6D98363F9BAA277C71954E
SHA-512:	E10C3FD9C5F34260323CEC9E8EEDF2290F40254F0FFDCA582DB57D113B32871793CDFFF03D55941EF5E79FA8141803AB353BA4938357A4555233F2D090045338
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........B..B..B..K.`.&..-..A..-...U..-...K..-..U..B..t..-...]..-...C..-..C..RichB..........PE..d...;.*Q.........."............................@............................. ......&................ ..................................................H.......T....... +..........Pa..T...................p3..(...p2...............3...............................text............................... ..`.imrsiv..................................rdata....... ......................@..@.data...x...........................@....pdata..T...........................@..@.rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\xOu8\LockScreenContentServer.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47600
Entropy (8bit):	6.182394161787695
Encrypted:	false
SSDEEP:	768:0SD9dkiWX/i7Ek29r9Hu53ldEkUZGYP7loL1Prco:pVKFudldlUZGYP7loPwo
MD5:	45E51238434FAF543D66E17EF3783413
SHA1:	1CE0BA884E5C2ADA74A34D10F32A5E7431C66411
SHA-256:	DAFF63C2C374463E0CF476B5CBADF2D58D0DADE0BB0C29DDAE543A69BA34FB93
SHA-512:	353467F3477B136909C1AD0206A3E9CA84AC9104B386529345BBEBABFCA1B3239F6C0B387C2C1018B937885144D43ACAADA264EB4D266B815A632A3DFEDEB331
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........4E..gE..gE..gL.4gg..g..fG..g..fQ..g..fB..g..fT..gE..g...g..fC..g.XgD..g*..fD..gRichE..g................PE..d...\|dV..........."......>...Z.......@.........@..........................................`.......... .......................................h.......... ................#......L....a..T....................U..(....T...............U...............................text....<.......>.................. ..`.rdata..`@...P...B...B..............@..@.data...............................@....pdata..............................@..@.rsrc... ...........................@..@.reloc..L...........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\xOu8\dwmapi.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1507328
Entropy (8bit):	4.717208456102618
Encrypted:	false
SSDEEP:	12288:IVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:dfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5:	ED1EC4C1EFFCC510E3B9663B916CEE94
SHA1:	A5D5CDE05C3D219B38D2478154BDD2303400E4B3
SHA-256:	E928425FDDD9EF3FBF255CD067DB453417ABACDB1BC9B50473A36CD655E804FC
SHA-512:	B4E4D48CF37D2463E67FFE62467BBA163FA33AA26ABB475D80076A04006560A225137D8D7F4B36B50D608EB52C437B04A1BC31928EC6EEBA11000F51A284B6F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.#..DN^.........." ................p..........@....................................@lx}..b.............................................&....c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\y7FgRNmA\DUI70.dll Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1789952
Entropy (8bit):	5.18319370146472
Encrypted:	false
SSDEEP:	12288:PVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1mrGy:mfP7fWsK5z9A+WGAW+V5SB6Ct4bnbmy
MD5:	F00DC6D1F73547993C34EFBDB69108E2
SHA1:	3AF5EB57D1D583986B1E77D18208423F236316FA
SHA-256:	8384EAFCD2DE1D1275528DE3114E3A0A643233C9F5F10F65D2A235FB836BF26C
SHA-512:	A5ACA81A6E905F71E5F19CD9550C346027FD02EF4F660CB87D2A4F7639939092CF7DFC137290448774AD26A2823E003FEB5B501C1BD425EA6746B90281A647AC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|..[.K./}...I.h}..u.Y.k\|.......\|..W"...\|..b.L.t\|...\|...}......N\|..2%...\|..Rich.\|..............................................................................................................PE..d.#..DN^.........." .........0......p..........@.............................P......@lx}..b.............................................dQ...c..........h.......................$#................................................... ...............................text............................... ..`.rdata...O... ...P... ..............@..@.data....x...p.......p..............@....pdata..,...........................A..@.rsrc...............................@..@.reloc..$#.......0..................@..B.qkm....J....@.......@..............@..@.cvjb...f...

C:\Users\user\AppData\Local\y7FgRNmA\dpapimig.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	5.908989367752963
Encrypted:	false
SSDEEP:	1536:CzbG9gXEurcYIZh800l3uU1HIED1fCbWpygzU:obezur2hrSJj16bE
MD5:	EE7DB7B615B48D8F9F08FAE70CAF46D7
SHA1:	FB5021297FDF24000ADD478164EEC8048871B335
SHA-256:	7999B821F8A673B0528C8F5F72A68A61393BEF78785FC1B4A0B3938D8CDD14B8
SHA-512:	F2292577166A330409813215DD49F2A276739AB51621316FBD418A377F4FD2476E50720A88F3069D16146E5C57DF47B21D800089EE48B28158BCBCFE3B6776AB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............nx..nx..nx......nx...{..nx...\|..nx...}..nx...y..nx..ny..nx...q..nx......nx...z..nx.Rich.nx.................PE..d...Y............."......"..........@'.........@....................................+.....`.......... .......................................L..........@....................p..P....H..T............................@...............A...............................text.... .......".................. ..`.rdata... ...@..."...&..............@..@.data........p.......H..............@....pdata...............J..............@..@.rsrc...@............L..............@..@.reloc..P....p.......*..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\89dad5d484a9f889a3a8dfca823edc3e_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	4447
Entropy (8bit):	5.462775166120593
Encrypted:	false
SSDEEP:	48:JfSr3rUT4mr/exe2enZ6bIQTVlofSr3rUTUi/Cjy76ziFDEXfQk3g8Tduoq:JfoWyM2eFfo1i/wtzLvQk3Huoq
MD5:	143CF11BF139B3754CAA7FE5CBC79A38
SHA1:	0825B6D02AAC1B9494B0F9AE7AEBA321E12B4025
SHA-256:	DFED9C74937B0C99C8B8E1F742BDC22EA1EC3F6D09A8FF96DB342905B2766794
SHA-512:	8CC1EE998E11AFB2F0468B2502477425D61D273B4D39ED832212A49CE33481C61D2BD0C90B15A7AF8B3B707326D7251086E20D54C640A83C29D1017F7CAF5152
Malicious:	false
Preview:	........................................user.........................................user.....................RSA1....................3Ot...y.~..1..4..5.]. ...t:..0.\|...5...#..l...:.R\|6.._a.^.`a..w..h..h0.n.w.../;..}{....S...Nc.hp.~^..6..2....y.........................z..O.........{R.uH............,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ....h~...D..Y...{....[{{...O.P............... ...;..X..n.C.Z"v.W.....\....2r.=.......Va.!....a.[.D...\|....h........:t.h.:T.X!...N.p...e...l..-x......r..N0....*jV...u.Q.>..u.#...B........F.....S,.0.G.[.!....n..O<.wQ.......X?.........@k.[........<.~.%0..e...b.......1.'........f).o....U....H...[p..5.........g..lr...B...&X.....P....b..Y...=....S.u.. i.....5. T..2Hz.L.c..c.a/H2#..n..k./.DP.`(.,..U.o.Z.B....a..t..Y.].....8...[...Lq./....l.o...X......!Y...M.-.g..Lo.y.h.....mL'P...x.I.+.\|...&2W.M........rGsOn....%."P.bb.e..A..=..>...?.tKn;......#......w..Q.b.0....^..?.L..H..x......#.A.pz...s9..O..k.Y0Qu(.

Static File Info

General
File type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Entropy (8bit):	5.920279505250315
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	2qTIaOLW2o.dll
File size:	1503232
MD5:	8ad564b939e5a713e39154c7e566adc6
SHA1:	8cd069a890ab232fca75a17e324de60c426f3115
SHA256:	1fa221f1d5a2c006943c6986babc756890b79c2b38380403789e54f467e1a84c
SHA512:	d23b0ca458cc91756ac7bc15934a040c71ac4a270676ff42bd9e20e1675736084bd9820f6456bf4da784a4cf5d7556df16be07af770a19d931349c003e9ca46f
SSDEEP:	24576:wfP7fWsK5z9A+WGAW+V5SB6Ct4bnb2Gw:MDW/e+WG0Vo6CtSn3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|...\|...\|....K.#}...'...}......{}....X.#}....f..\|....g..}.....a\|.......}....N..}.....E}..[.I.E\|...'..U}....N.+}..[.K.P\|.

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x140041070
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x5E4E44CC [Thu Feb 20 08:35:24 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6668be91e2c948b183827f040944057f

Entrypoint Preview

Instruction
dec eax
xor eax, eax
dec eax
add eax, 5Ah
dec eax
mov dword ptr [00073D82h], ecx
dec eax
lea ecx, dword ptr [FFFFECABh]
dec eax
mov dword ptr [00073D7Ch], edx
dec eax
add eax, ecx
dec esp
mov dword ptr [00073D92h], ecx
dec esp
mov dword ptr [00073DA3h], ebp
dec esp
mov dword ptr [00073D7Ch], eax
dec esp
mov dword ptr [00073D85h], edi
dec esp
mov dword ptr [00073D86h], esi
dec esp
mov dword ptr [00073D8Fh], esp
dec eax
mov ecx, eax
dec eax
sub ecx, 5Ah
dec eax
mov dword ptr [00073D89h], esi
dec eax
test eax, eax
je 00007FBD5CBFFE9Fh
dec eax
mov dword ptr [00073D45h], esp
dec eax
mov dword ptr [00073D36h], ebp
dec eax
mov dword ptr [00073D7Fh], ebx
dec eax
mov dword ptr [00073D70h], edi
dec eax
test eax, eax
je 00007FBD5CBFFE7Eh
jmp ecx
dec eax
add edi, ecx
dec eax
mov dword ptr [FFFFEC37h], ecx
dec eax
xor ecx, eax
jmp ecx
retn 0008h
ud2
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebx
dec eax
sub esp, 00000080h
mov eax, F957B016h
mov byte ptr [esp+7Fh], 00000037h
mov edx, dword ptr [esp+78h]
inc ecx
mov eax, edx
inc ecx
or eax, 5D262B0Ch
inc esp
mov dword ptr [esp+78h], eax
dec eax
mov dword ptr [eax+eax+00h], 00000000h

Rich Headers

Programming Language:

[LNK] VS2012 UPD4 build 61030
[ASM] VS2013 UPD2 build 30501
[ C ] VS2012 UPD2 build 60315
[C++] VS2013 UPD4 build 31101
[RES] VS2012 UPD3 build 60610
[LNK] VS2017 v15.5.4 build 25834
[ C ] VS2017 v15.5.4 build 25834
[ASM] VS2010 build 30319
[EXP] VS2015 UPD1 build 23506
[IMP] VS2008 SP1 build 30729
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD2 build 60315
[C++] VS2015 UPD1 build 23506
[ C ] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x129010	0x45164	.xsnm
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa6390	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc0000	0x468	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc1000	0x2324	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x42000	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x40796	0x41000	False	0.776085486779	data	7.73364605679	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x42000	0x64fcb	0x65000	False	0.702262047494	data	7.86510283498	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa7000	0x178b8	0x18000	False	0.0694580078125	data	3.31515306295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0xbf000	0x12c	0x1000	False	0.06005859375	PEX Binary Archive	0.581723022719	IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc0000	0x880	0x1000	False	0.139892578125	data	1.23838501563	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc1000	0x2324	0x3000	False	0.0498046875	data	4.65321444248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.qkm	0xc4000	0x74a	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.cvjb	0xc5000	0x1e66	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tlmkv	0xc7000	0xbde	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.wucsxe	0xc8000	0x45174	0x46000	False	0.0010498046875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.wnx	0x10e000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.weqy	0x10f000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.yby	0x110000	0x1278	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ormx	0x112000	0xbde	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.dhclu	0x113000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xmiul	0x114000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tlwcxe	0x115000	0x13e	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.get	0x116000	0xbde	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.hzrd	0x117000	0x1124	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gfrpb	0x119000	0x389	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ymlijr	0x11a000	0x1f7	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tntrb	0x11b000	0x389	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rmvhl	0x11c000	0x128f	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.ukcyi	0x11e000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.knmra	0x11f000	0x1f7	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.wtn	0x120000	0x13e	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.kjnw	0x121000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.okpgp	0x122000	0x1f2a	0x2000	False	0.0037841796875	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.oxbitk	0x124000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.dplkzo	0x125000	0x8fe	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.psnue	0x126000	0x543	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.lida	0x127000	0x9cd	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.arovjd	0x128000	0x23b	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xsnm	0x129000	0x45174	0x46000	False	0.218526785714	data	5.75845428978	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xc00a0	0x370	data	English	United States
RT_MANIFEST	0xc0410	0x56	ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
USER32.dll	LookupIconIdFromDirectoryEx, WaitForInputIdle, GetParent, GetFocus
SETUPAPI.dll	CM_Get_Resource_Conflict_DetailsW
KERNEL32.dll	DeleteCriticalSection, DeleteTimerQueue, TerminateJobObject, GetFileInformationByHandle, GetThreadLocale, GetNamedPipeServerProcessId, GetConsoleFontSize
GDI32.dll	CreateBitmapIndirect, GetPolyFillMode
CRYPT32.dll	CertGetCTLContextProperty
ADVAPI32.dll	AddAccessDeniedObjectAce
SHLWAPI.dll	ChrCmpIW

Exports

Name	Ordinal	Address
??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ	1	0x140036cfc
??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ	2	0x14003fe30
??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ	3	0x1400144a4
??0?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@QEAA@XZ	4	0x14001d41c
??0?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@QEAA@XZ	5	0x1400023dc
??0?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@QEAA@XZ	6	0x140032e94
??0?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@QEAA@XZ	7	0x140033efc
??0?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@QEAA@XZ	8	0x14000623c
??0?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@QEAA@XZ	9	0x140021d8c
??0?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@QEAA@XZ	10	0x140013d84
??0?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@QEAA@XZ	11	0x140014c1c
??0?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@QEAA@XZ	12	0x14002d8cc
??0?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@QEAA@XZ	13	0x140039f70
??0?$SafeArrayAccessor@H@DirectUI@@QEAA@XZ	14	0x140020044
??0AccessibleButton@DirectUI@@QEAA@$$QEAV01@@Z	15	0x140003724
??0AccessibleButton@DirectUI@@QEAA@AEBV01@@Z	16	0x14001c8c4
??0AccessibleButton@DirectUI@@QEAA@XZ	17	0x14003eee8
??0AnimationStrip@DirectUI@@QEAA@AEBV01@@Z	18	0x140017858
??0AnimationStrip@DirectUI@@QEAA@XZ	19	0x140018070
??0AutoButton@DirectUI@@QEAA@$$QEAV01@@Z	20	0x14001d44c
??0AutoButton@DirectUI@@QEAA@AEBV01@@Z	21	0x14002a1ec
??0AutoButton@DirectUI@@QEAA@XZ	22	0x1400398a0
??0AutoLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z	23	0x1400100dc
??0AutoThread@DirectUI@@QEAA@XZ	24	0x140040854
??0AutoVariant@DirectUI@@QEAA@XZ	25	0x140011f80
??0BaseScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	26	0x14002d090
??0BaseScrollBar@DirectUI@@QEAA@AEBV01@@Z	27	0x14003f7e8
??0BaseScrollBar@DirectUI@@QEAA@XZ	28	0x140024be4
??0BaseScrollViewer@DirectUI@@QEAA@AEBV01@@Z	29	0x140035c28
??0BaseScrollViewer@DirectUI@@QEAA@XZ	30	0x1400315d4
??0Bind@DirectUI@@QEAA@$$QEAV01@@Z	31	0x140013b1c
??0Bind@DirectUI@@QEAA@AEBV01@@Z	32	0x14000f2e8
??0Bind@DirectUI@@QEAA@XZ	33	0x14000e768
??0BorderLayout@DirectUI@@QEAA@AEBV01@@Z	34	0x140008ac4
??0BorderLayout@DirectUI@@QEAA@XZ	35	0x1400074e4
??0Browser@DirectUI@@QEAA@$$QEAV01@@Z	36	0x14002bf30
??0Browser@DirectUI@@QEAA@AEBV01@@Z	37	0x1400039dc
??0Browser@DirectUI@@QEAA@XZ	38	0x14001be8c
??0BrowserSelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z	39	0x1400312f4
??0BrowserSelectionProxy@DirectUI@@QEAA@AEBV01@@Z	40	0x14003ab80
??0BrowserSelectionProxy@DirectUI@@QEAA@XZ	41	0x140019da4
??0Button@DirectUI@@QEAA@AEBV01@@Z	42	0x140013c84
??0Button@DirectUI@@QEAA@XZ	43	0x1400320a0
??0CCAVI@DirectUI@@QEAA@$$QEAV01@@Z	44	0x1400025a0
??0CCAVI@DirectUI@@QEAA@AEBV01@@Z	45	0x14000de18
??0CCAVI@DirectUI@@QEAA@XZ	46	0x140036f84
??0CCBase@DirectUI@@QEAA@AEBV01@@Z	47	0x140018f1c
??0CCBase@DirectUI@@QEAA@KPEBG@Z	48	0x14001da0c
??0CCBaseCheckRadioButton@DirectUI@@QEAA@$$QEAV01@@Z	49	0x140002684
??0CCBaseCheckRadioButton@DirectUI@@QEAA@AEBV01@@Z	50	0x14001a60c
??0CCBaseCheckRadioButton@DirectUI@@QEAA@K@Z	51	0x140010a58
??0CCBaseScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	52	0x14003644c
??0CCBaseScrollBar@DirectUI@@QEAA@AEBV01@@Z	53	0x140012078
??0CCBaseScrollBar@DirectUI@@QEAA@K@Z	54	0x140007424
??0CCCheckBox@DirectUI@@QEAA@$$QEAV01@@Z	55	0x14003c960
??0CCCheckBox@DirectUI@@QEAA@AEBV01@@Z	56	0x140041360
??0CCCheckBox@DirectUI@@QEAA@K@Z	57	0x14003f5e4
??0CCCommandLink@DirectUI@@QEAA@$$QEAV01@@Z	58	0x14000ecc4
??0CCCommandLink@DirectUI@@QEAA@AEBV01@@Z	59	0x14001f8b0
??0CCCommandLink@DirectUI@@QEAA@K@Z	60	0x14002812c
??0CCHScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	61	0x14003f660
??0CCHScrollBar@DirectUI@@QEAA@AEBV01@@Z	62	0x14002d264
??0CCHScrollBar@DirectUI@@QEAA@XZ	63	0x14001c3d4
??0CCListBox@DirectUI@@QEAA@$$QEAV01@@Z	64	0x1400023bc
??0CCListBox@DirectUI@@QEAA@AEBV01@@Z	65	0x140011b98
??0CCListBox@DirectUI@@QEAA@XZ	66	0x14002f2f0
??0CCListView@DirectUI@@QEAA@$$QEAV01@@Z	67	0x14002d104
??0CCListView@DirectUI@@QEAA@AEBV01@@Z	68	0x14003e558
??0CCListView@DirectUI@@QEAA@XZ	69	0x14000b020
??0CCProgressBar@DirectUI@@QEAA@$$QEAV01@@Z	70	0x14002eee4
??0CCProgressBar@DirectUI@@QEAA@AEBV01@@Z	71	0x1400290d0
??0CCProgressBar@DirectUI@@QEAA@XZ	72	0x14001a724
??0CCPushButton@DirectUI@@QEAA@$$QEAV01@@Z	73	0x140028520
??0CCPushButton@DirectUI@@QEAA@AEBV01@@Z	74	0x140009bbc
??0CCPushButton@DirectUI@@QEAA@K@Z	75	0x140012770
??0CCRadioButton@DirectUI@@QEAA@$$QEAV01@@Z	76	0x14001f5d4
??0CCRadioButton@DirectUI@@QEAA@AEBV01@@Z	77	0x140007388
??0CCRadioButton@DirectUI@@QEAA@XZ	78	0x14003c7a0
??0CCSysLink@DirectUI@@QEAA@$$QEAV01@@Z	79	0x14003c158
??0CCSysLink@DirectUI@@QEAA@AEBV01@@Z	80	0x1400067e0
??0CCSysLink@DirectUI@@QEAA@XZ	81	0x14003284c
??0CCTrackBar@DirectUI@@QEAA@$$QEAV01@@Z	82	0x14002a8e8
??0CCTrackBar@DirectUI@@QEAA@AEBV01@@Z	83	0x140004590
??0CCTrackBar@DirectUI@@QEAA@XZ	84	0x14001e8ac
??0CCTreeView@DirectUI@@QEAA@$$QEAV01@@Z	85	0x140028748
??0CCTreeView@DirectUI@@QEAA@AEBV01@@Z	86	0x14003c168
??0CCTreeView@DirectUI@@QEAA@K@Z	87	0x14003d4c4
??0CCVScrollBar@DirectUI@@QEAA@$$QEAV01@@Z	88	0x140027fcc
??0CCVScrollBar@DirectUI@@QEAA@AEBV01@@Z	89	0x1400268ec
??0CCVScrollBar@DirectUI@@QEAA@XZ	90	0x14000ed08
??0CallstackTracker@DirectUI@@QEAA@XZ	91	0x140035498
??0CheckBoxGlyph@DirectUI@@QEAA@AEBV01@@Z	92	0x14002b66c
??0CheckBoxGlyph@DirectUI@@QEAA@XZ	93	0x140008640
??0ClassInfoBase@DirectUI@@QEAA@AEBV01@@Z	94	0x14003c318
??0ClassInfoBase@DirectUI@@QEAA@XZ	95	0x1400035f4
??0Clipper@DirectUI@@QEAA@$$QEAV01@@Z	96	0x140009164
??0Clipper@DirectUI@@QEAA@AEBV01@@Z	97	0x140041440
??0Clipper@DirectUI@@QEAA@XZ	98	0x140015e40
??0Combobox@DirectUI@@QEAA@AEBV01@@Z	99	0x1400361b0
??0Combobox@DirectUI@@QEAA@XZ	100	0x140001e28
??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z	101	0x140035e50
??0DCSurface@DirectUI@@QEAA@AEBV01@@Z	102	0x14002cfe0
??0DCSurface@DirectUI@@QEAA@PEAUHDC__@@@Z	103	0x14003f6cc
??0DUIFactory@DirectUI@@QEAA@PEAUHWND__@@@Z	104	0x140006c24
??0DUIXmlParser@DirectUI@@QEAA@AEBV01@@Z	105	0x140018724
??0DUIXmlParser@DirectUI@@QEAA@XZ	106	0x1400248c4
??0DialogElement@DirectUI@@QEAA@$$QEAV01@@Z	107	0x14000dca8
??0DialogElement@DirectUI@@QEAA@AEBV01@@Z	108	0x140006518
??0DialogElement@DirectUI@@QEAA@XZ	109	0x1400127bc
??0DuiAccessible@DirectUI@@QEAA@XZ	110	0x140032868
??0Edit@DirectUI@@QEAA@AEBV01@@Z	111	0x14002a684
??0Edit@DirectUI@@QEAA@XZ	112	0x140033a68
??0Element@DirectUI@@QEAA@AEBV01@@Z	113	0x14003d900
??0Element@DirectUI@@QEAA@XZ	114	0x1400016ec
??0ElementProvider@DirectUI@@QEAA@XZ	115	0x14002e6f0
??0ElementProxy@DirectUI@@IEAA@XZ	116	0x1400275c8
??0ElementProxy@DirectUI@@QEAA@$$QEAV01@@Z	117	0x14001df54
??0ElementProxy@DirectUI@@QEAA@AEBV01@@Z	118	0x1400286c8
??0ElementWithHWND@DirectUI@@QEAA@$$QEAV01@@Z	119	0x1400394f8
??0ElementWithHWND@DirectUI@@QEAA@AEBV01@@Z	120	0x140034554
??0ElementWithHWND@DirectUI@@QEAA@XZ	121	0x1400361a0
??0ExpandCollapseProvider@DirectUI@@QEAA@XZ	122	0x14000cba0
??0ExpandCollapseProxy@DirectUI@@QEAA@$$QEAV01@@Z	123	0x140030148
??0ExpandCollapseProxy@DirectUI@@QEAA@AEBV01@@Z	124	0x140035e94
??0ExpandCollapseProxy@DirectUI@@QEAA@XZ	125	0x14002a5a8
??0Expandable@DirectUI@@QEAA@$$QEAV01@@Z	126	0x14002ee58
??0Expandable@DirectUI@@QEAA@AEBV01@@Z	127	0x140001418
??0Expandable@DirectUI@@QEAA@XZ	128	0x140034ae0
??0Expando@DirectUI@@QEAA@$$QEAV01@@Z	129	0x14003a600
??0Expando@DirectUI@@QEAA@AEBV01@@Z	130	0x14003fe5c
??0Expando@DirectUI@@QEAA@XZ	131	0x14002bdc0
??0ExpandoButtonGlyph@DirectUI@@QEAA@AEBV01@@Z	132	0x14002dcb4
??0ExpandoButtonGlyph@DirectUI@@QEAA@XZ	133	0x140025610
??0FillLayout@DirectUI@@QEAA@AEBV01@@Z	134	0x14000b1b8
??0FillLayout@DirectUI@@QEAA@XZ	135	0x14000f12c
??0FlowLayout@DirectUI@@QEAA@AEBV01@@Z	136	0x14001627c
??0FlowLayout@DirectUI@@QEAA@XZ	137	0x14001d008
??0FontCache@DirectUI@@QEAA@$$QEAV01@@Z	138	0x1400172c8
??0FontCache@DirectUI@@QEAA@AEBV01@@Z	139	0x140031800
??0FontCache@DirectUI@@QEAA@XZ	140	0x140038e00
??0FontCheckOut@DirectUI@@QEAA@PEAVElement@1@PEAUHDC__@@@Z	141	0x14001bff0
??0GridItemProvider@DirectUI@@QEAA@XZ	142	0x14001f350
??0GridItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	143	0x140006ef4
??0GridItemProxy@DirectUI@@QEAA@AEBV01@@Z	144	0x1400342c4
??0GridItemProxy@DirectUI@@QEAA@XZ	145	0x14002bcf4
??0GridLayout@DirectUI@@QEAA@AEBV01@@Z	146	0x14002cc18
??0GridLayout@DirectUI@@QEAA@XZ	147	0x140033bd8
??0GridProvider@DirectUI@@QEAA@XZ	148	0x1400190c4
??0GridProxy@DirectUI@@QEAA@$$QEAV01@@Z	149	0x140023220
??0GridProxy@DirectUI@@QEAA@AEBV01@@Z	150	0x14002fdc0
??0GridProxy@DirectUI@@QEAA@XZ	151	0x14002a11c
??0HWNDElement@DirectUI@@QEAA@AEBV01@@Z	152	0x14001f9e0
??0HWNDElement@DirectUI@@QEAA@XZ	153	0x140035230
??0HWNDElementAccessible@DirectUI@@QEAA@XZ	154	0x140005404
??0HWNDElementProvider@DirectUI@@QEAA@XZ	155	0x14002b388
??0HWNDElementProxy@DirectUI@@IEAA@XZ	156	0x14002d5bc
??0HWNDElementProxy@DirectUI@@QEAA@$$QEAV01@@Z	157	0x1400308ec
??0HWNDElementProxy@DirectUI@@QEAA@AEBV01@@Z	158	0x140038b20
??0HWNDHost@DirectUI@@QEAA@AEBV01@@Z	159	0x140016c3c
??0HWNDHost@DirectUI@@QEAA@XZ	160	0x14000ad74
??0HWNDHostAccessible@DirectUI@@QEAA@XZ	161	0x140029ac4
??0HWNDHostClientAccessible@DirectUI@@QEAA@XZ	162	0x140008f58
??0IDataEngine@DirectUI@@QEAA@AEBU01@@Z	163	0x14002a3cc
??0IDataEngine@DirectUI@@QEAA@XZ	164	0x140028fd8
??0IDataEntry@DirectUI@@QEAA@AEBU01@@Z	165	0x1400220ec
??0IDataEntry@DirectUI@@QEAA@XZ	166	0x14000fec8
??0IProvider@DirectUI@@QEAA@$$QEAV01@@Z	167	0x14002f1fc
??0IProvider@DirectUI@@QEAA@AEBV01@@Z	168	0x14000f9f0
??0IProvider@DirectUI@@QEAA@XZ	169	0x140013a18
??0ISBLeak@DirectUI@@QEAA@$$QEAU01@@Z	170	0x140014ae0
??0ISBLeak@DirectUI@@QEAA@AEBU01@@Z	171	0x140028924
??0ISBLeak@DirectUI@@QEAA@XZ	172	0x1400336b0
??0IXElementCP@DirectUI@@QEAA@$$QEAV01@@Z	173	0x140007258
??0IXElementCP@DirectUI@@QEAA@AEBV01@@Z	174	0x140010778
??0IXElementCP@DirectUI@@QEAA@XZ	175	0x140020588
??0IXProviderCP@DirectUI@@QEAA@$$QEAV01@@Z	176	0x140008ce8
??0IXProviderCP@DirectUI@@QEAA@AEBV01@@Z	177	0x14002b83c
??0IXProviderCP@DirectUI@@QEAA@XZ	178	0x14003cb3c
??0InvokeHelper@DirectUI@@QEAA@XZ	179	0x14000b7ac
??0InvokeProvider@DirectUI@@QEAA@XZ	180	0x14003d24c
??0InvokeProxy@DirectUI@@QEAA@$$QEAV01@@Z	181	0x14001bf0c
??0InvokeProxy@DirectUI@@QEAA@AEBV01@@Z	182	0x14003ac38
??0InvokeProxy@DirectUI@@QEAA@XZ	183	0x14003ca38
??0ItemList@DirectUI@@QEAA@XZ	184	0x140033548
??0Layout@DirectUI@@QEAA@AEBV01@@Z	185	0x14001569c
??0Layout@DirectUI@@QEAA@XZ	186	0x140005df0
??0LinkedList@DirectUI@@QEAA@XZ	187	0x14003c2d0
??0Macro@DirectUI@@QEAA@$$QEAV01@@Z	188	0x14002911c
??0Macro@DirectUI@@QEAA@AEBV01@@Z	189	0x140013cf4
??0Macro@DirectUI@@QEAA@XZ	190	0x140036f2c
??0ModernProgressBar@DirectUI@@QEAA@XZ	191	0x14002e28c
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	192	0x14002519c
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	193	0x1400287ec
??0ModernProgressBarRangeValueProxy@DirectUI@@QEAA@XZ	194	0x1400321a8
??0ModernProgressRing@DirectUI@@QEAA@XZ	195	0x14001ccac
??0Movie@DirectUI@@QEAA@AEBV01@@Z	196	0x140013f40
??0Movie@DirectUI@@QEAA@XZ	197	0x140029f60
??0NativeHWNDHost@DirectUI@@QEAA@AEBV01@@Z	198	0x140040878
??0NativeHWNDHost@DirectUI@@QEAA@XZ	199	0x14003bc9c
??0Navigator@DirectUI@@QEAA@$$QEAV01@@Z	200	0x14000f5e0
??0Navigator@DirectUI@@QEAA@AEBV01@@Z	201	0x14001dcc4
??0Navigator@DirectUI@@QEAA@XZ	202	0x140033e7c
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	203	0x1400239d8
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z	204	0x140010054
??0NavigatorSelectionItemProxy@DirectUI@@QEAA@XZ	205	0x14001f50c
??0NineGridLayout@DirectUI@@QEAA@AEBV01@@Z	206	0x140024688
??0NineGridLayout@DirectUI@@QEAA@XZ	207	0x140021488
??0PText@DirectUI@@QEAA@AEBV01@@Z	208	0x14003f43c
??0PText@DirectUI@@QEAA@XZ	209	0x140007d98
??0Page@DirectUI@@QEAA@$$QEAV01@@Z	210	0x14002ad9c
??0Page@DirectUI@@QEAA@AEBV01@@Z	211	0x14003a438
??0Page@DirectUI@@QEAA@XZ	212	0x140005f38
??0Pages@DirectUI@@QEAA@$$QEAV01@@Z	213	0x1400067fc
??0Pages@DirectUI@@QEAA@AEBV01@@Z	214	0x14001f0ac
??0Pages@DirectUI@@QEAA@XZ	215	0x140006964
??0Progress@DirectUI@@QEAA@AEBV01@@Z	216	0x14002a598
??0Progress@DirectUI@@QEAA@XZ	217	0x140003308
??0ProgressRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	218	0x140035080
??0ProgressRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	219	0x140014080
??0ProgressRangeValueProxy@DirectUI@@QEAA@XZ	220	0x1400376e4
??0ProviderProxy@DirectUI@@IEAA@XZ	221	0x140012318
??0ProviderProxy@DirectUI@@QEAA@$$QEAV01@@Z	222	0x14002756c
??0ProviderProxy@DirectUI@@QEAA@AEBV01@@Z	223	0x140010a38
??0Proxy@DirectUI@@QEAA@AEBV01@@Z	224	0x140026f10
??0Proxy@DirectUI@@QEAA@XZ	225	0x140023408
??0PushButton@DirectUI@@QEAA@$$QEAV01@@Z	226	0x1400112a4
??0PushButton@DirectUI@@QEAA@AEBV01@@Z	227	0x1400103f0
??0PushButton@DirectUI@@QEAA@XZ	228	0x14002b7d8
??0RadioButtonGlyph@DirectUI@@QEAA@AEBV01@@Z	229	0x14000dc7c
??0RadioButtonGlyph@DirectUI@@QEAA@XZ	230	0x140024b3c
??0RangeValueProvider@DirectUI@@QEAA@XZ	231	0x140019e9c
??0RangeValueProxy@DirectUI@@IEAA@XZ	232	0x14003c2b4
??0RangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	233	0x14003ca68
??0RangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	234	0x14000d574
??0RefPointElement@DirectUI@@QEAA@AEBV01@@Z	235	0x14003ff94
??0RefPointElement@DirectUI@@QEAA@XZ	236	0x140005260
??0RefcountBase@DirectUI@@QEAA@XZ	237	0x14003968c
??0RepeatButton@DirectUI@@QEAA@AEBV01@@Z	238	0x1400230e0
??0RepeatButton@DirectUI@@QEAA@XZ	239	0x1400059ec
??0Repeater@DirectUI@@QEAA@$$QEAV01@@Z	240	0x140001ff8
??0Repeater@DirectUI@@QEAA@AEBV01@@Z	241	0x140022420
??0Repeater@DirectUI@@QEAA@XZ	242	0x14000f0a4
??0ResourceModuleHandles@DirectUI@@QEAA@XZ	243	0x1400011f8
??0RichText@DirectUI@@QEAA@XZ	244	0x14001cb88
??0RowLayout@DirectUI@@QEAA@AEBV01@@Z	245	0x14002cabc
??0RowLayout@DirectUI@@QEAA@XZ	246	0x14001b190
??0ScrollBar@DirectUI@@QEAA@AEBV01@@Z	247	0x14002d2c0
??0ScrollBar@DirectUI@@QEAA@XZ	248	0x14003988c
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	249	0x1400211b8
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@AEBV01@@Z	250	0x14003001c
??0ScrollBarRangeValueProxy@DirectUI@@QEAA@XZ	251	0x140018820
??0ScrollItemProvider@DirectUI@@QEAA@XZ	252	0x140025c58
??0ScrollItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	253	0x1400226f8
??0ScrollItemProxy@DirectUI@@QEAA@AEBV01@@Z	254	0x140040254
??0ScrollItemProxy@DirectUI@@QEAA@XZ	255	0x14003b1b8
??0ScrollProvider@DirectUI@@QEAA@XZ	256	0x14000cee4
??0ScrollProxy@DirectUI@@QEAA@$$QEAV01@@Z	257	0x140038bf0
??0ScrollProxy@DirectUI@@QEAA@AEBV01@@Z	258	0x140031cbc
??0ScrollProxy@DirectUI@@QEAA@XZ	259	0x140030eb0
??0ScrollViewer@DirectUI@@QEAA@AEBV01@@Z	260	0x140015590
??0ScrollViewer@DirectUI@@QEAA@XZ	261	0x14002d7d8
??0SelectionItemProvider@DirectUI@@QEAA@XZ	262	0x140022b00
??0SelectionItemProxy@DirectUI@@IEAA@XZ	263	0x14002c950
??0SelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	264	0x1400023f0
??0SelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z	265	0x140006f70
??0SelectionProvider@DirectUI@@QEAA@XZ	266	0x140012ff4
??0SelectionProxy@DirectUI@@IEAA@XZ	267	0x140007b40
??0SelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z	268	0x1400221fc
??0SelectionProxy@DirectUI@@QEAA@AEBV01@@Z	269	0x140029574
??0Selector@DirectUI@@QEAA@AEBV01@@Z	270	0x140018b38
??0Selector@DirectUI@@QEAA@XZ	271	0x14001ffe4
??0SelectorNoDefault@DirectUI@@QEAA@$$QEAV01@@Z	272	0x14003bb00
??0SelectorNoDefault@DirectUI@@QEAA@AEBV01@@Z	273	0x14000ed60
??0SelectorNoDefault@DirectUI@@QEAA@XZ	274	0x14001f808
??0SelectorSelectionItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	275	0x140007b40
??0SelectorSelectionItemProxy@DirectUI@@QEAA@AEBV01@@Z	276	0x140038c7c
??0SelectorSelectionItemProxy@DirectUI@@QEAA@XZ	277	0x140007f98
??0SelectorSelectionProxy@DirectUI@@QEAA@$$QEAV01@@Z	278	0x1400074d4
??0SelectorSelectionProxy@DirectUI@@QEAA@AEBV01@@Z	279	0x140031d4c
??0SelectorSelectionProxy@DirectUI@@QEAA@XZ	280	0x14001ea98
??0ShellBorderLayout@DirectUI@@QEAA@AEBV01@@Z	281	0x140033b50
??0ShellBorderLayout@DirectUI@@QEAA@XZ	282	0x14002b2a4
??0StyleSheet@DirectUI@@QEAA@$$QEAV01@@Z	283	0x140014a88
??0StyleSheet@DirectUI@@QEAA@AEBV01@@Z	284	0x140015528
??0StyleSheet@DirectUI@@QEAA@XZ	285	0x14002eb9c
??0StyledScrollViewer@DirectUI@@QEAA@AEBV01@@Z	286	0x14000c3c8
??0StyledScrollViewer@DirectUI@@QEAA@XZ	287	0x140027fa4
??0Surface@DirectUI@@QEAA@AEBV01@@Z	288	0x140009db8
??0Surface@DirectUI@@QEAA@XZ	289	0x14002494c
??0TableItemProvider@DirectUI@@QEAA@XZ	290	0x1400184bc
??0TableItemProxy@DirectUI@@QEAA@$$QEAV01@@Z	291	0x140037794
??0TableItemProxy@DirectUI@@QEAA@AEBV01@@Z	292	0x140024c28
??0TableItemProxy@DirectUI@@QEAA@XZ	293	0x1400103fc
??0TableLayout@DirectUI@@QEAA@AEBV01@@Z	294	0x1400308f8
??0TableLayout@DirectUI@@QEAA@XZ	295	0x140003480
??0TableProvider@DirectUI@@QEAA@XZ	296	0x140024a14
??0TableProxy@DirectUI@@QEAA@$$QEAV01@@Z	297	0x1400117d8
??0TableProxy@DirectUI@@QEAA@AEBV01@@Z	298	0x1400366d4
??0TableProxy@DirectUI@@QEAA@XZ	299	0x14002ed10
??0TaskPage@DirectUI@@QEAA@AEBV01@@Z	300	0x14000a058
??0TaskPage@DirectUI@@QEAA@XZ	301	0x14001cd08
??0TextGraphic@DirectUI@@QEAA@$$QEAV01@@Z	302	0x140029d90
??0TextGraphic@DirectUI@@QEAA@AEBV01@@Z	303	0x1400159bc
??0TextGraphic@DirectUI@@QEAA@XZ	304	0x140022d74
??0Thumb@DirectUI@@QEAA@AEBV01@@Z	305	0x140032cd0
??0Thumb@DirectUI@@QEAA@XZ	306	0x14002acd0
??0ToggleProvider@DirectUI@@QEAA@XZ	307	0x14002ce80
??0ToggleProxy@DirectUI@@QEAA@$$QEAV01@@Z	308	0x140034b70
??0ToggleProxy@DirectUI@@QEAA@AEBV01@@Z	309	0x14003a80c
??0ToggleProxy@DirectUI@@QEAA@XZ	310	0x14001efd0
??0TouchButton@DirectUI@@QEAA@XZ	311	0x140028994
??0TouchCheckBox@DirectUI@@QEAA@XZ	312	0x14001860c
??0TouchCheckBoxGlyph@DirectUI@@QEAA@XZ	313	0x140026ef4
??0TouchCommandButton@DirectUI@@QEAA@XZ	314	0x140028490
??0TouchEdit2@DirectUI@@QEAA@XZ	315	0x140018ee8
??0TouchHWNDElement@DirectUI@@QEAA@XZ	316	0x14003c058
??0TouchHyperLink@DirectUI@@QEAA@XZ	317	0x14001fd88
??0TouchRepeatButton@DirectUI@@QEAA@XZ	318	0x1400288dc
??0TouchScrollBar@DirectUI@@QEAA@XZ	319	0x140004e64
??0TouchSelect@DirectUI@@QEAA@XZ	320	0x14003fa14
??0TouchSelectItem@DirectUI@@QEAA@XZ	321	0x14002d9d4
??0UnknownElement@DirectUI@@QEAA@AEBV01@@Z	322	0x14002003c
??0UnknownElement@DirectUI@@QEAA@XZ	323	0x14000e3e4
??0ValueProvider@DirectUI@@QEAA@XZ	324	0x140027cd0
??0ValueProxy@DirectUI@@QEAA@$$QEAV01@@Z	325	0x140022310
??0ValueProxy@DirectUI@@QEAA@AEBV01@@Z	326	0x140029a84
??0ValueProxy@DirectUI@@QEAA@XZ	327	0x140036458
??0VerticalFlowLayout@DirectUI@@QEAA@AEBV01@@Z	328	0x140006738
??0VerticalFlowLayout@DirectUI@@QEAA@XZ	329	0x14002fa88
??0Viewer@DirectUI@@QEAA@AEBV01@@Z	330	0x140003c44
??0Viewer@DirectUI@@QEAA@XZ	331	0x140028e34
??0XBaby@DirectUI@@QEAA@AEBV01@@Z	332	0x140024b9c
??0XBaby@DirectUI@@QEAA@XZ	333	0x14003b390
??0XElement@DirectUI@@QEAA@AEBV01@@Z	334	0x1400298fc
??0XElement@DirectUI@@QEAA@XZ	335	0x140033d28
??0XHost@DirectUI@@QEAA@XZ	336	0x14000b34c
??0XProvider@DirectUI@@QEAA@AEBV01@@Z	337	0x140013374
??0XProvider@DirectUI@@QEAA@XZ	338	0x140002224
??0XResourceProvider@DirectUI@@QEAA@$$QEAV01@@Z	339	0x14003963c
??0XResourceProvider@DirectUI@@QEAA@AEBV01@@Z	340	0x14002c4e4
??0XResourceProvider@DirectUI@@QEAA@XZ	341	0x14000e4ec
??1?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@UEAA@XZ	342	0x140010994
??1?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@UEAA@XZ	343	0x140027638
??1?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@UEAA@XZ	344	0x140017f9c
??1?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@UEAA@XZ	345	0x1400099c8
??1?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@UEAA@XZ	346	0x140041278
??1?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@UEAA@XZ	347	0x140034d6c
??1?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@UEAA@XZ	348	0x14001e378
??1?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@UEAA@XZ	349	0x140003adc
??1?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@UEAA@XZ	350	0x140003b58
??1?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@UEAA@XZ	351	0x1400409a4
??1?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@UEAA@XZ	352	0x14001e110
??1?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@UEAA@XZ	353	0x14003a99c
??1?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@UEAA@XZ	354	0x14000c690
??1?$SafeArrayAccessor@H@DirectUI@@QEAA@XZ	355	0x14001d13c
??1AccessibleButton@DirectUI@@UEAA@XZ	356	0x140017600
??1AnimationStrip@DirectUI@@UEAA@XZ	357	0x1400338c8
??1AutoButton@DirectUI@@UEAA@XZ	358	0x14001c46c
??1AutoLock@DirectUI@@QEAA@XZ	359	0x14001ba9c
??1AutoThread@DirectUI@@QEAA@XZ	360	0x14001c044
??1AutoVariant@DirectUI@@QEAA@XZ	361	0x140023fb8
??1BaseScrollViewer@DirectUI@@UEAA@XZ	362	0x1400031f4
??1Bind@DirectUI@@UEAA@XZ	363	0x14000f9d0
??1BorderLayout@DirectUI@@UEAA@XZ	364	0x14004159c
??1Browser@DirectUI@@UEAA@XZ	365	0x140015bdc
??1Button@DirectUI@@UEAA@XZ	366	0x140038444
??1CCAVI@DirectUI@@UEAA@XZ	367	0x1400312f4
??1CCBase@DirectUI@@UEAA@XZ	368	0x1400129ac
??1CCBaseCheckRadioButton@DirectUI@@UEAA@XZ	369	0x14002e948
??1CCBaseScrollBar@DirectUI@@UEAA@XZ	370	0x1400105d4
??1CCCheckBox@DirectUI@@UEAA@XZ	371	0x14003ce14
??1CCCommandLink@DirectUI@@UEAA@XZ	372	0x140010e88
??1CCHScrollBar@DirectUI@@UEAA@XZ	373	0x14003da9c
??1CCListBox@DirectUI@@UEAA@XZ	374	0x140005fb8
??1CCListView@DirectUI@@UEAA@XZ	375	0x14001e28c
??1CCProgressBar@DirectUI@@UEAA@XZ	376	0x140012744
??1CCPushButton@DirectUI@@UEAA@XZ	377	0x14000e30c
??1CCRadioButton@DirectUI@@UEAA@XZ	378	0x140013b84
??1CCSysLink@DirectUI@@UEAA@XZ	379	0x14000164c
??1CCTrackBar@DirectUI@@UEAA@XZ	380	0x14003d384
??1CCTreeView@DirectUI@@UEAA@XZ	381	0x14002e2f0
??1CCVScrollBar@DirectUI@@UEAA@XZ	382	0x140023cd4
??1CallstackTracker@DirectUI@@QEAA@XZ	383	0x14000849c
??1CheckBoxGlyph@DirectUI@@UEAA@XZ	384	0x140005fec
??1ClassInfoBase@DirectUI@@UEAA@XZ	385	0x14000d070
??1Clipper@DirectUI@@UEAA@XZ	386	0x14001f558
??1Combobox@DirectUI@@UEAA@XZ	387	0x14002cdbc
??1CritSecLock@DirectUI@@QEAA@XZ	388	0x1400213f0
??1DCSurface@DirectUI@@UEAA@XZ	389	0x1400255e0
??1DUIFactory@DirectUI@@QEAA@XZ	390	0x14001209c
??1DUIXmlParser@DirectUI@@UEAA@XZ	391	0x140022e80
??1DialogElement@DirectUI@@UEAA@XZ	392	0x14000ab98
??1DuiAccessible@DirectUI@@UEAA@XZ	393	0x140014b58
??1Edit@DirectUI@@UEAA@XZ	394	0x140013a88
??1Element@DirectUI@@UEAA@XZ	395	0x140024eac
??1ElementProvider@DirectUI@@UEAA@XZ	396	0x140002dfc
??1ElementWithHWND@DirectUI@@UEAA@XZ	397	0x140003584
??1ExpandCollapseProvider@DirectUI@@UEAA@XZ	398	0x140009a7c
??1Expandable@DirectUI@@UEAA@XZ	399	0x140028a0c
??1Expando@DirectUI@@UEAA@XZ	400	0x14000c5d4
??1ExpandoButtonGlyph@DirectUI@@UEAA@XZ	401	0x140033b90
??1FillLayout@DirectUI@@UEAA@XZ	402	0x140004bdc
??1FlowLayout@DirectUI@@UEAA@XZ	403	0x140028d1c
??1FontCheckOut@DirectUI@@QEAA@XZ	404	0x140023204
??1GridItemProvider@DirectUI@@UEAA@XZ	405	0x14000127c
??1GridLayout@DirectUI@@UEAA@XZ	406	0x14001b11c
??1GridProvider@DirectUI@@UEAA@XZ	407	0x140007794
??1HWNDElement@DirectUI@@UEAA@XZ	408	0x140012554
??1HWNDElementAccessible@DirectUI@@UEAA@XZ	409	0x14001fa0c
??1HWNDElementProvider@DirectUI@@UEAA@XZ	410	0x140009244
??1HWNDHost@DirectUI@@UEAA@XZ	411	0x140020720
??1HWNDHostAccessible@DirectUI@@UEAA@XZ	412	0x140028c58
??1HWNDHostClientAccessible@DirectUI@@UEAA@XZ	413	0x14001e8c8
??1IDataEngine@DirectUI@@UEAA@XZ	414	0x140036bd0
??1IDataEntry@DirectUI@@UEAA@XZ	415	0x14003ab54
??1InvokeHelper@DirectUI@@UEAA@XZ	416	0x14001898c
??1InvokeProvider@DirectUI@@UEAA@XZ	417	0x14003e060
??1ItemList@DirectUI@@UEAA@XZ	418	0x140041770
??1Layout@DirectUI@@UEAA@XZ	419	0x1400222a4
??1LinkedList@DirectUI@@QEAA@XZ	420	0x140018ab0
??1Macro@DirectUI@@UEAA@XZ	421	0x140036d58
??1ModernProgressBar@DirectUI@@UEAA@XZ	422	0x14003fce0
??1ModernProgressRing@DirectUI@@UEAA@XZ	423	0x1400212cc
??1Movie@DirectUI@@UEAA@XZ	424	0x14002f3d4
??1NativeHWNDHost@DirectUI@@UEAA@XZ	425	0x140038bfc
??1Navigator@DirectUI@@UEAA@XZ	426	0x140002d6c
??1NineGridLayout@DirectUI@@UEAA@XZ	427	0x14000a754
??1PText@DirectUI@@UEAA@XZ	428	0x140022f38
??1Page@DirectUI@@UEAA@XZ	429	0x14002c9c8
??1Pages@DirectUI@@UEAA@XZ	430	0x14000af54
??1Progress@DirectUI@@UEAA@XZ	431	0x140028974
??1Proxy@DirectUI@@UEAA@XZ	432	0x1400088fc
??1PushButton@DirectUI@@UEAA@XZ	433	0x140040358
??1RadioButtonGlyph@DirectUI@@UEAA@XZ	434	0x14002c350
??1RangeValueProvider@DirectUI@@UEAA@XZ	435	0x140015e04
??1RefPointElement@DirectUI@@UEAA@XZ	436	0x14003b5b0
??1RefcountBase@DirectUI@@UEAA@XZ	437	0x14003047c
??1RepeatButton@DirectUI@@UEAA@XZ	438	0x14002a3a8
??1Repeater@DirectUI@@UEAA@XZ	439	0x140020f5c
??1ResourceModuleHandles@DirectUI@@QEAA@XZ	440	0x140016c8c
??1RichText@DirectUI@@UEAA@XZ	441	0x1400400ac
??1RowLayout@DirectUI@@UEAA@XZ	442	0x140001efc
??1ScrollBar@DirectUI@@UEAA@XZ	443	0x140017200
??1ScrollItemProvider@DirectUI@@UEAA@XZ	444	0x140035dec
??1ScrollProvider@DirectUI@@UEAA@XZ	445	0x14001914c
??1ScrollViewer@DirectUI@@UEAA@XZ	446	0x140019968
??1SelectionItemProvider@DirectUI@@UEAA@XZ	447	0x1400082b0
??1SelectionProvider@DirectUI@@UEAA@XZ	448	0x14001e3ac
??1Selector@DirectUI@@UEAA@XZ	449	0x140018898
??1SelectorNoDefault@DirectUI@@UEAA@XZ	450	0x1400135b4
??1ShellBorderLayout@DirectUI@@UEAA@XZ	451	0x140034564
??1StyledScrollViewer@DirectUI@@UEAA@XZ	452	0x140013d78
??1Surface@DirectUI@@UEAA@XZ	453	0x140001cac
??1TableItemProvider@DirectUI@@UEAA@XZ	454	0x140036f20
??1TableLayout@DirectUI@@UEAA@XZ	455	0x14002f9d0
??1TableProvider@DirectUI@@UEAA@XZ	456	0x14003df64
??1TaskPage@DirectUI@@UEAA@XZ	457	0x140001e68
??1TextGraphic@DirectUI@@UEAA@XZ	458	0x14003ae5c
??1Thumb@DirectUI@@UEAA@XZ	459	0x14002c194
??1ToggleProvider@DirectUI@@UEAA@XZ	460	0x140020238
??1TouchButton@DirectUI@@UEAA@XZ	461	0x1400093c0
??1TouchCheckBox@DirectUI@@UEAA@XZ	462	0x1400052f4
??1TouchCheckBoxGlyph@DirectUI@@UEAA@XZ	463	0x1400191d0
??1TouchHWNDElement@DirectUI@@UEAA@XZ	464	0x14001d46c
??1TouchHyperLink@DirectUI@@UEAA@XZ	465	0x14001ec30
??1TouchScrollBar@DirectUI@@UEAA@XZ	466	0x1400201e8
??1TouchSelect@DirectUI@@UEAA@XZ	467	0x14003d1b4
??1TouchSelectItem@DirectUI@@UEAA@XZ	468	0x14002ea2c
??1UnknownElement@DirectUI@@UEAA@XZ	469	0x1400302bc
??1ValueProvider@DirectUI@@UEAA@XZ	470	0x14001475c
??1VerticalFlowLayout@DirectUI@@UEAA@XZ	471	0x14002250c
??1Viewer@DirectUI@@UEAA@XZ	472	0x140034288
??1XBaby@DirectUI@@UEAA@XZ	473	0x1400172f8
??1XElement@DirectUI@@UEAA@XZ	474	0x140039634
??1XHost@DirectUI@@QEAA@XZ	475	0x14001b65c
??1XProvider@DirectUI@@UEAA@XZ	476	0x14000b7f0
??4?$FunctionDefinition@H@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	477	0x140001a34
??4?$FunctionDefinition@H@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	478	0x140007f70
??4?$FunctionDefinition@K@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	479	0x14002a108
??4?$FunctionDefinition@K@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	480	0x140023450
??4?$FunctionDefinition@PEAVValue@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	481	0x14002ad60
??4?$FunctionDefinition@PEAVValue@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	482	0x140034e60
??4?$FunctionDefinition@UScaledRECT@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	483	0x1400306dc
??4?$FunctionDefinition@UScaledRECT@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	484	0x14002cf70
??4?$FunctionDefinition@UScaledSIZE@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	485	0x14000eb84
??4?$FunctionDefinition@UScaledSIZE@DirectUI@@@DUIXmlParser@DirectUI@@QEAAAEAU012@AEBU012@@Z	486	0x14002db80
??4ACCESSIBLEROLE@AccessibleButton@DirectUI@@QEAAAEAU012@$$QEAU012@@Z	487	0x14000674c
??4ACCESSIBLEROLE@AccessibleButton@DirectUI@@QEAAAEAU012@AEBU012@@Z	488	0x140011470
??4AccessibleButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	489	0x1400039b4
??4AccessibleButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	490	0x140022288
??4AnimationStrip@DirectUI@@QEAAAEAV01@AEBV01@@Z	491	0x140004220
??4AutoButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	492	0x140031260
??4AutoButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	493	0x140036f5c
??4AutoLock@DirectUI@@QEAAAEAV01@AEBV01@@Z	494	0x14000f3dc
??4AutoThread@DirectUI@@QEAAAEAV01@AEBV01@@Z	495	0x1400029cc
??4AutoVariant@DirectUI@@QEAAAEAV01@AEBV01@@Z	496	0x140037d5c
??4BaseScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	497	0x14000f4b4
??4BaseScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	498	0x14001b018
??4BaseScrollViewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	499	0x14003fbec
??4Bind@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	500	0x140009ae8
??4Bind@DirectUI@@QEAAAEAV01@AEBV01@@Z	501	0x14003b060
??4BorderLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	502	0x14002a6f8
??4Browser@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	503	0x14000fb4c
??4Browser@DirectUI@@QEAAAEAV01@AEBV01@@Z	504	0x140024c70
??4BrowserSelectionProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	505	0x140009740
??4BrowserSelectionProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	506	0x140020b10
??4Button@DirectUI@@QEAAAEAV01@AEBV01@@Z	507	0x14000a8e0
??4CCAVI@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	508	0x140004664
??4CCAVI@DirectUI@@QEAAAEAV01@AEBV01@@Z	509	0x140025ccc
??4CCBase@DirectUI@@QEAAAEAV01@AEBV01@@Z	510	0x140009614
??4CCBaseCheckRadioButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	511	0x1400074e0
??4CCBaseCheckRadioButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	512	0x140041114
??4CCBaseScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	513	0x14003c624
??4CCBaseScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	514	0x140033430
??4CCCheckBox@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	515	0x140011e1c
??4CCCheckBox@DirectUI@@QEAAAEAV01@AEBV01@@Z	516	0x14003dff8
??4CCCommandLink@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	517	0x140003b38
??4CCCommandLink@DirectUI@@QEAAAEAV01@AEBV01@@Z	518	0x140019e4c
??4CCHScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	519	0x140011628
??4CCHScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	520	0x140019f78
??4CCListBox@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	521	0x14004112c
??4CCListBox@DirectUI@@QEAAAEAV01@AEBV01@@Z	522	0x14000e974
??4CCListView@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	523	0x14002dee8
??4CCListView@DirectUI@@QEAAAEAV01@AEBV01@@Z	524	0x14003589c
??4CCProgressBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	525	0x140039f2c
??4CCProgressBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	526	0x140006fcc
??4CCPushButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	527	0x14003577c
??4CCPushButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	528	0x14003a2fc
??4CCRadioButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	529	0x1400362c0
??4CCRadioButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	530	0x140018190
??4CCSysLink@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	531	0x140024ce8
??4CCSysLink@DirectUI@@QEAAAEAV01@AEBV01@@Z	532	0x14002e978
??4CCTrackBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	533	0x14003217c
??4CCTrackBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	534	0x14000a6f4
??4CCTreeView@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	535	0x14000d200
??4CCTreeView@DirectUI@@QEAAAEAV01@AEBV01@@Z	536	0x140031eb4
??4CCVScrollBar@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	537	0x140028c70
??4CCVScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	538	0x140027350
??4CallstackTracker@DirectUI@@QEAAAEAV01@AEBV01@@Z	539	0x1400270ac
??4CheckBoxGlyph@DirectUI@@QEAAAEAV01@AEBV01@@Z	540	0x14000f360
??4ClassInfoBase@DirectUI@@QEAAAEAV01@AEBV01@@Z	541	0x140001dfc
??4Clipper@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	542	0x14001afec
??4Clipper@DirectUI@@QEAAAEAV01@AEBV01@@Z	543	0x1400345d0
??4Combobox@DirectUI@@QEAAAEAV01@AEBV01@@Z	544	0x140020920
??4CritSecLock@DirectUI@@QEAAAEAV01@AEBV01@@Z	545	0x14000eb18
??4DCSurface@DirectUI@@QEAAAEAV01@AEBV01@@Z	546	0x140022e90
??4DUIFactory@DirectUI@@QEAAAEAV01@AEBV01@@Z	547	0x140002ee8
??4DUIXmlParser@DirectUI@@QEAAAEAV01@AEBV01@@Z	548	0x1400399a0
??4DialogElement@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	549	0x1400106e0
??4DialogElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	550	0x14002c580
??4DialogElementCore@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	551	0x140019490
??4DialogElementCore@DirectUI@@QEAAAEAV01@AEBV01@@Z	552	0x14001e008
??4DuiNavigate@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	553	0x14002a5c0
??4DuiNavigate@DirectUI@@QEAAAEAV01@AEBV01@@Z	554	0x140037628
??4Edit@DirectUI@@QEAAAEAV01@AEBV01@@Z	555	0x1400095b0
??4Element@DirectUI@@QEAAAEAV01@AEBV01@@Z	556	0x14003add0
??4ElementProviderManager@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	557	0x14003fa5c
??4ElementProviderManager@DirectUI@@QEAAAEAV01@AEBV01@@Z	558	0x14003bc14
??4ElementProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	559	0x140018330
??4ElementProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	560	0x140016cb0
??4ElementWithHWND@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	561	0x140007080
??4ElementWithHWND@DirectUI@@QEAAAEAV01@AEBV01@@Z	562	0x140004aec
??4EventManager@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	563	0x14000a858
??4EventManager@DirectUI@@QEAAAEAV01@AEBV01@@Z	564	0x14002ac38
??4ExpandCollapseProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	565	0x140038fcc
??4ExpandCollapseProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	566	0x140017038
??4Expandable@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	567	0x14002136c
??4Expandable@DirectUI@@QEAAAEAV01@AEBV01@@Z	568	0x14003271c
??4Expando@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	569	0x140012728
??4Expando@DirectUI@@QEAAAEAV01@AEBV01@@Z	570	0x140008ff4
??4ExpandoButtonGlyph@DirectUI@@QEAAAEAV01@AEBV01@@Z	571	0x140003878
??4Expression@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	572	0x14003c5f0
??4Expression@DirectUI@@QEAAAEAV01@AEBV01@@Z	573	0x14003bd90
??4FillLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	574	0x1400157e8
??4FlowLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	575	0x14000b254
??4FontCache@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	576	0x14002b988
??4FontCache@DirectUI@@QEAAAEAV01@AEBV01@@Z	577	0x14001bee4
??4FontCheckOut@DirectUI@@QEAAAEAV01@AEBV01@@Z	578	0x14000a6e0
??4GridItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	579	0x14000519c
??4GridItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	580	0x1400285d4
??4GridLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	581	0x1400104c8
??4GridProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	582	0x140034740
??4GridProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	583	0x140031e98
??4HWNDElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	584	0x140011e8c
??4HWNDElementProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	585	0x1400019c0
??4HWNDElementProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	586	0x140001198
??4HWNDHost@DirectUI@@QEAAAEAV01@AEBV01@@Z	587	0x140032584
??4IDataEngine@DirectUI@@QEAAAEAU01@AEBU01@@Z	588	0x140019134
??4IDataEntry@DirectUI@@QEAAAEAU01@AEBU01@@Z	589	0x140022264
??4IProvider@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	590	0x14002aa6c
??4IProvider@DirectUI@@QEAAAEAV01@AEBV01@@Z	591	0x1400204dc
??4ISBLeak@DirectUI@@QEAAAEAU01@$$QEAU01@@Z	592	0x140014958
??4ISBLeak@DirectUI@@QEAAAEAU01@AEBU01@@Z	593	0x140032964
??4IXElementCP@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	594	0x1400379c8
??4IXElementCP@DirectUI@@QEAAAEAV01@AEBV01@@Z	595	0x1400169e8
??4IXProviderCP@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	596	0x14000607c
??4IXProviderCP@DirectUI@@QEAAAEAV01@AEBV01@@Z	597	0x14002a668
??4InvokeManager@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	598	0x140035b98
??4InvokeManager@DirectUI@@QEAAAEAV01@AEBV01@@Z	599	0x140006b4c
??4InvokeProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	600	0x140021f14
??4InvokeProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	601	0x1400411f0
??4Layout@DirectUI@@QEAAAEAV01@AEBV01@@Z	602	0x14001533c
??4LinkedList@DirectUI@@QEAAAEAV01@AEBV01@@Z	603	0x140040e88
??4LinkedListNode@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	604	0x14003ba20
??4LinkedListNode@DirectUI@@QEAAAEAV01@AEBV01@@Z	605	0x14002e708
??4Macro@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	606	0x140006258
??4Macro@DirectUI@@QEAAAEAV01@AEBV01@@Z	607	0x14003f5d0
??4ModernProgressBarRangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	608	0x14003e1dc
??4ModernProgressBarRangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	609	0x140033898
??4Movie@DirectUI@@QEAAAEAV01@AEBV01@@Z	610	0x14001e59c
??4NativeHWNDHost@DirectUI@@QEAAAEAV01@AEBV01@@Z	611	0x140014cfc
??4NavReference@DirectUI@@QEAAAEAU01@$$QEAU01@@Z	612	0x1400096c4
??4NavReference@DirectUI@@QEAAAEAU01@AEBU01@@Z	613	0x14001d578
??4NavScoring@DirectUI@@QEAAAEAU01@$$QEAU01@@Z	614	0x1400138f0
??4NavScoring@DirectUI@@QEAAAEAU01@AEBU01@@Z	615	0x140022be0
??4Navigator@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	616	0x14002d1e0
??4Navigator@DirectUI@@QEAAAEAV01@AEBV01@@Z	617	0x14003dd74
??4NavigatorSelectionItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	618	0x14000b268
??4NavigatorSelectionItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	619	0x14003b5b0
??4NineGridLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	620	0x14000cd74
??4PText@DirectUI@@QEAAAEAV01@AEBV01@@Z	621	0x14003db80
??4PVLAnimation@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	622	0x14001b994
??4PVLAnimation@DirectUI@@QEAAAEAV01@AEBV01@@Z	623	0x140022698
??4Page@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	624	0x1400295b0
??4Page@DirectUI@@QEAAAEAV01@AEBV01@@Z	625	0x14000cb64
??4Pages@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	626	0x14000b8c4
??4Pages@DirectUI@@QEAAAEAV01@AEBV01@@Z	627	0x140037828
??4Progress@DirectUI@@QEAAAEAV01@AEBV01@@Z	628	0x14000c174
??4ProgressRangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	629	0x14002e770
??4ProgressRangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	630	0x140028e40
??4ProviderProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	631	0x14000419c
??4ProviderProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	632	0x140006fc8
??4Proxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	633	0x140036c84
??4PushButton@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	634	0x14003b9ac
??4PushButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	635	0x14000654c
??4RadioButtonGlyph@DirectUI@@QEAAAEAV01@AEBV01@@Z	636	0x140021b14
??4RangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	637	0x1400292f8
??4RangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	638	0x1400318ac
??4RefPointElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	639	0x14003998c
??4RepeatButton@DirectUI@@QEAAAEAV01@AEBV01@@Z	640	0x1400201d8
??4Repeater@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	641	0x140033094
??4Repeater@DirectUI@@QEAAAEAV01@AEBV01@@Z	642	0x140027954
??4ResourceModuleHandles@DirectUI@@QEAAAEAV01@AEBV01@@Z	643	0x14003cc38
??4RowLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	644	0x140040054
??4Schema@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	645	0x140021068
??4Schema@DirectUI@@QEAAAEAV01@AEBV01@@Z	646	0x140002e30
??4ScrollBar@DirectUI@@QEAAAEAV01@AEBV01@@Z	647	0x140022cf4
??4ScrollBarRangeValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	648	0x140026a98
??4ScrollBarRangeValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	649	0x14001dd60
??4ScrollItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	650	0x140021334
??4ScrollItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	651	0x14000f14c
??4ScrollProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	652	0x14002238c
??4ScrollProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	653	0x140039258
??4ScrollViewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	654	0x14002990c
??4SelectionItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	655	0x140003f0c
??4SelectionItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	656	0x1400374dc
??4SelectionProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	657	0x14001e888
??4SelectionProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	658	0x14000bae8
??4Selector@DirectUI@@QEAAAEAV01@AEBV01@@Z	659	0x14001f610
??4SelectorNoDefault@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	660	0x1400144e8
??4SelectorNoDefault@DirectUI@@QEAAAEAV01@AEBV01@@Z	661	0x14002cca8
??4SelectorSelectionItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	662	0x1400359d8
??4SelectorSelectionItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	663	0x140028d0c
??4SelectorSelectionProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	664	0x140017b38
??4SelectorSelectionProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	665	0x1400118b4
??4ShellBorderLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	666	0x14001d6dc
??4StyleSheet@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	667	0x14001c3cc
??4StyleSheet@DirectUI@@QEAAAEAV01@AEBV01@@Z	668	0x1400055f8
??4StyledScrollViewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	669	0x140036c44
??4Surface@DirectUI@@QEAAAEAV01@AEBV01@@Z	670	0x140003564
??4TableItemProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	671	0x14001c55c
??4TableItemProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	672	0x14003e520
??4TableLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	673	0x140024e4c
??4TableProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	674	0x14002f72c
??4TableProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	675	0x14002fa00
??4TaskPage@DirectUI@@QEAAAEAV01@AEBV01@@Z	676	0x140022f58
??4TextGraphic@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	677	0x14003e200
??4TextGraphic@DirectUI@@QEAAAEAV01@AEBV01@@Z	678	0x140014c78
??4Thumb@DirectUI@@QEAAAEAV01@AEBV01@@Z	679	0x14003fc98
??4ToggleProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	680	0x140036a30
??4ToggleProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	681	0x14000dd44
??4UnknownElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	682	0x14002ea18
??4Value@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	683	0x140004078
??4Value@DirectUI@@QEAAAEAV01@AEBV01@@Z	684	0x140015860
??4ValueProxy@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	685	0x14002ff84
??4ValueProxy@DirectUI@@QEAAAEAV01@AEBV01@@Z	686	0x14001a40c
??4VerticalFlowLayout@DirectUI@@QEAAAEAV01@AEBV01@@Z	687	0x140039a20
??4Viewer@DirectUI@@QEAAAEAV01@AEBV01@@Z	688	0x140022bbc
??4XBaby@DirectUI@@QEAAAEAV01@AEBV01@@Z	689	0x14002b180
??4XElement@DirectUI@@QEAAAEAV01@AEBV01@@Z	690	0x14002b5ec
??4XHost@DirectUI@@QEAAAEAV01@AEBV01@@Z	691	0x14001bc74
??4XProvider@DirectUI@@QEAAAEAV01@AEBV01@@Z	692	0x1400318a0
??4XResourceProvider@DirectUI@@QEAAAEAV01@$$QEAV01@@Z	693	0x14003a640
??4XResourceProvider@DirectUI@@QEAAAEAV01@AEBV01@@Z	694	0x1400052f8
??B?$SafeArrayAccessor@H@DirectUI@@QEAAPEAHXZ	695	0x14001dbbc
??BTaskPage@DirectUI@@QEAAPEAU_PSP@@XZ	696	0x14000678c
??_7?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@6BIProvider@1@@	697	0x140023ec8
??_7?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@6BRefcountBase@1@@	698	0x140004778
??_7?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@6BIProvider@1@@	699	0x140036c98
??_7?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@6BRefcountBase@1@@	700	0x140019ef0
??_7?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@6BIProvider@1@@	701	0x140011d94
??_7?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@6BRefcountBase@1@@	702	0x1400100dc
??_7?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@6BIProvider@1@@	703	0x1400407bc
??_7?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@6BRefcountBase@1@@	704	0x1400252b0
??_7?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@6BIProvider@1@@	705	0x1400367cc
??_7?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@6BRefcountBase@1@@	706	0x140040c24
??_7?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@6BIProvider@1@@	707	0x14002d754
??_7?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@6BRefcountBase@1@@	708	0x140025e1c
??_7?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@6BIProvider@1@@	709	0x140017e0c
??_7?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@6BRefcountBase@1@@	710	0x14002f6a4
??_7?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@6BIProvider@1@@	711	0x14000fbc4
??_7?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@6BRefcountBase@1@@	712	0x14002a518
??_7?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@6BIProvider@1@@	713	0x1400048ec
??_7?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@6BRefcountBase@1@@	714	0x140037ebc
??_7?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@6BIProvider@1@@	715	0x14002f8d4
??_7?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@6BRefcountBase@1@@	716	0x14002b6dc
??_7?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@6BIProvider@1@@	717	0x14002c574
??_7?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@6BRefcountBase@1@@	718	0x14000e784
??_7?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@6BIProvider@1@@	719	0x140011ef8
??_7?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@6BRefcountBase@1@@	720	0x14002f370
??_7?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@6BIProvider@1@@	721	0x140008f14
??_7?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@6BRefcountBase@1@@	722	0x140039870
??_7AccessibleButton@DirectUI@@6B@	723	0x1400334e8
??_7AnimationStrip@DirectUI@@6B@	724	0x140030880
??_7AutoButton@DirectUI@@6B@	725	0x1400290f0
??_7BaseScrollBar@DirectUI@@6B@	726	0x140019370
??_7BaseScrollViewer@DirectUI@@6BElement@1@@	727	0x140031ea0
??_7BaseScrollViewer@DirectUI@@6BIElementListener@1@@	728	0x140009284
??_7Bind@DirectUI@@6B@	729	0x140015d00
??_7BorderLayout@DirectUI@@6B@	730	0x14001daec
??_7Browser@DirectUI@@6B@	731	0x1400124b0
??_7BrowserSelectionProxy@DirectUI@@6B@	732	0x14001de64
??_7Button@DirectUI@@6B@	733	0x140022ac4
??_7CCAVI@DirectUI@@6B@	734	0x14002c070
??_7CCBase@DirectUI@@6B@	735	0x140015d50
??_7CCBaseCheckRadioButton@DirectUI@@6B@	736	0x140011f2c
??_7CCBaseScrollBar@DirectUI@@6BBaseScrollBar@1@@	737	0x140021ddc
??_7CCBaseScrollBar@DirectUI@@6BCCBase@1@@	738	0x14001d594
??_7CCCheckBox@DirectUI@@6B@	739	0x14000f88c
??_7CCCommandLink@DirectUI@@6B@	740	0x140010f30
??_7CCHScrollBar@DirectUI@@6BBaseScrollBar@1@@	741	0x140027f10
??_7CCHScrollBar@DirectUI@@6BCCBase@1@@	742	0x1400149a8
??_7CCListBox@DirectUI@@6B@	743	0x14002710c
??_7CCListView@DirectUI@@6B@	744	0x14002c66c
??_7CCProgressBar@DirectUI@@6B@	745	0x14003ef34
??_7CCPushButton@DirectUI@@6B@	746	0x14001a660
??_7CCRadioButton@DirectUI@@6B@	747	0x14003fa14
??_7CCSysLink@DirectUI@@6B@	748	0x14001b05c
??_7CCTrackBar@DirectUI@@6B@	749	0x140006ae0
??_7CCTreeView@DirectUI@@6B@	750	0x1400037b8
??_7CCVScrollBar@DirectUI@@6BBaseScrollBar@1@@	751	0x14000d2c4
??_7CCVScrollBar@DirectUI@@6BCCBase@1@@	752	0x14002e2ec
??_7CheckBoxGlyph@DirectUI@@6B@	753	0x140004bd4
??_7ClassInfoBase@DirectUI@@6B@	754	0x14001b1c8
??_7Clipper@DirectUI@@6B@	755	0x14001b3dc
??_7Combobox@DirectUI@@6B@	756	0x14003022c
??_7DCSurface@DirectUI@@6B@	757	0x14001ff94
??_7DUIXmlParser@DirectUI@@6B@	758	0x140032a1c
??_7DialogElement@DirectUI@@6BHWNDElement@1@@	759	0x1400148e0
??_7DialogElement@DirectUI@@6BIDialogElement@1@@	760	0x140037088
??_7DialogElement@DirectUI@@6BIElementListener@1@@	761	0x14003d684
??_7DuiAccessible@DirectUI@@6BIAccIdentity@@@	762	0x140033010
??_7DuiAccessible@DirectUI@@6BIAccessible@@@	763	0x14002334c
??_7DuiAccessible@DirectUI@@6BIEnumVARIANT@@@	764	0x140022d10
??_7DuiAccessible@DirectUI@@6BIOleWindow@@@	765	0x140018c54
??_7DuiAccessible@DirectUI@@6BIServiceProvider@@@	766	0x140014e18
??_7Edit@DirectUI@@6B@	767	0x14002e3bc
??_7Element@DirectUI@@6B@	768	0x14003b19c
??_7ElementProvider@DirectUI@@6BIRawElementProviderAdviseEvents@@@	769	0x14002e734
??_7ElementProvider@DirectUI@@6BIRawElementProviderFragment@@@	770	0x14003c86c
??_7ElementProvider@DirectUI@@6BIRawElementProviderSimple2@@@	771	0x1400087bc
??_7ElementProvider@DirectUI@@6BRefcountBase@1@@	772	0x140016940
??_7ElementWithHWND@DirectUI@@6B@	773	0x14002b21c
??_7ExpandCollapseProvider@DirectUI@@6B@	774	0x140037fec
??_7ExpandCollapseProvider@DirectUI@@6BIProvider@1@@	775	0x1400147d0
??_7ExpandCollapseProvider@DirectUI@@6BRefcountBase@1@@	776	0x140011a58
??_7ExpandCollapseProxy@DirectUI@@6B@	777	0x14002cf00
??_7Expandable@DirectUI@@6B@	778	0x140040c18
??_7Expando@DirectUI@@6B@	779	0x140032b78
??_7ExpandoButtonGlyph@DirectUI@@6B@	780	0x140017f38
??_7FillLayout@DirectUI@@6B@	781	0x14000df3c
??_7FlowLayout@DirectUI@@6B@	782	0x1400305ac
??_7FontCache@DirectUI@@6B@	783	0x140034e0c
??_7GridItemProvider@DirectUI@@6B@	784	0x140035e64
??_7GridItemProvider@DirectUI@@6BIProvider@1@@	785	0x14002dbd4
??_7GridItemProvider@DirectUI@@6BRefcountBase@1@@	786	0x14002d39c
??_7GridItemProxy@DirectUI@@6B@	787	0x14002f010
??_7GridLayout@DirectUI@@6B@	788	0x14002f33c
??_7GridProvider@DirectUI@@6B@	789	0x140020510
??_7GridProvider@DirectUI@@6BIProvider@1@@	790	0x14001b3d8
??_7GridProvider@DirectUI@@6BRefcountBase@1@@	791	0x1400155fc
??_7GridProxy@DirectUI@@6B@	792	0x14002c734
??_7HWNDElement@DirectUI@@6B@	793	0x1400251a4
??_7HWNDElementAccessible@DirectUI@@6BIAccIdentity@@@	794	0x14001cb28
??_7HWNDElementAccessible@DirectUI@@6BIAccessible@@@	795	0x1400244cc
??_7HWNDElementAccessible@DirectUI@@6BIEnumVARIANT@@@	796	0x14000dc10
??_7HWNDElementAccessible@DirectUI@@6BIOleWindow@@@	797	0x140025990
??_7HWNDElementAccessible@DirectUI@@6BIServiceProvider@@@	798	0x140018d24
??_7HWNDElementProvider@DirectUI@@6B@	799	0x14000a688
??_7HWNDElementProvider@DirectUI@@6BIRawElementProviderAdviseEvents@@@	800	0x140025178
??_7HWNDElementProvider@DirectUI@@6BIRawElementProviderFragment@@@	801	0x14000e828
??_7HWNDElementProvider@DirectUI@@6BIRawElementProviderSimple2@@@	802	0x140031620
??_7HWNDElementProvider@DirectUI@@6BRefcountBase@1@@	803	0x140037f94
??_7HWNDHost@DirectUI@@6B@	804	0x140026b90
??_7HWNDHostAccessible@DirectUI@@6BIAccIdentity@@@	805	0x14002d50c
??_7HWNDHostAccessible@DirectUI@@6BIAccessible@@@	806	0x140018ab8
??_7HWNDHostAccessible@DirectUI@@6BIEnumVARIANT@@@	807	0x140023d08
??_7HWNDHostAccessible@DirectUI@@6BIOleWindow@@@	808	0x140019bf0
??_7HWNDHostAccessible@DirectUI@@6BIServiceProvider@@@	809	0x1400136dc
??_7HWNDHostClientAccessible@DirectUI@@6BIAccIdentity@@@	810	0x14001a660
??_7HWNDHostClientAccessible@DirectUI@@6BIAccessible@@@	811	0x14000ccb0
??_7HWNDHostClientAccessible@DirectUI@@6BIEnumVARIANT@@@	812	0x140032ddc
??_7HWNDHostClientAccessible@DirectUI@@6BIOleWindow@@@	813	0x14002b718
??_7HWNDHostClientAccessible@DirectUI@@6BIServiceProvider@@@	814	0x14003fa14
??_7IDataEngine@DirectUI@@6B@	815	0x140020690
??_7IDataEntry@DirectUI@@6B@	816	0x14003fdb0
??_7ISBLeak@DirectUI@@6B@	817	0x14002cc6c
??_7IXElementCP@DirectUI@@6B@	818	0x140021e04
??_7IXProviderCP@DirectUI@@6B@	819	0x14003b97c
??_7InvokeHelper@DirectUI@@6B@	820	0x140038bd8
??_7InvokeProvider@DirectUI@@6B@	821	0x14003a5f0
??_7InvokeProvider@DirectUI@@6BIProvider@1@@	822	0x14001e7cc
??_7InvokeProvider@DirectUI@@6BRefcountBase@1@@	823	0x140026a24
??_7InvokeProxy@DirectUI@@6B@	824	0x1400319e8
??_7Layout@DirectUI@@6B@	825	0x14000fe08
??_7Macro@DirectUI@@6B@	826	0x140001b9c
??_7ModernProgressBarRangeValueProxy@DirectUI@@6B@	827	0x140033840
??_7Movie@DirectUI@@6B@	828	0x14003f120
??_7NativeHWNDHost@DirectUI@@6B@	829	0x140030b4c
??_7Navigator@DirectUI@@6B@	830	0x14001f0b0
??_7NavigatorSelectionItemProxy@DirectUI@@6B@	831	0x14002fcc8
??_7NineGridLayout@DirectUI@@6B@	832	0x140019e70
??_7PText@DirectUI@@6B@	833	0x1400143bc
??_7Page@DirectUI@@6B@	834	0x140036614
??_7Pages@DirectUI@@6B@	835	0x14002dca0
??_7Progress@DirectUI@@6B@	836	0x140030074
??_7ProgressRangeValueProxy@DirectUI@@6B@	837	0x140023cb4
??_7Proxy@DirectUI@@6B@	838	0x14004161c
??_7PushButton@DirectUI@@6B@	839	0x140012858
??_7RadioButtonGlyph@DirectUI@@6B@	840	0x14000ea2c
??_7RangeValueProvider@DirectUI@@6B@	841	0x1400327dc
??_7RangeValueProvider@DirectUI@@6BIProvider@1@@	842	0x1400312e0
??_7RangeValueProvider@DirectUI@@6BRefcountBase@1@@	843	0x140001464
??_7RangeValueProxy@DirectUI@@6B@	844	0x14000bce0
??_7RefPointElement@DirectUI@@6B@	845	0x14002b9cc
??_7RefcountBase@DirectUI@@6B@	846	0x140021cb0
??_7RepeatButton@DirectUI@@6B@	847	0x140009944
??_7Repeater@DirectUI@@6B@	848	0x14000e41c
??_7RowLayout@DirectUI@@6B@	849	0x14001e590
??_7ScrollBar@DirectUI@@6BBaseScrollBar@1@@	850	0x14001b448
??_7ScrollBar@DirectUI@@6BElement@1@@	851	0x140028d30
??_7ScrollBarRangeValueProxy@DirectUI@@6B@	852	0x14001cbb8
??_7ScrollItemProvider@DirectUI@@6B@	853	0x1400167b8
??_7ScrollItemProvider@DirectUI@@6BIProvider@1@@	854	0x14000f6e8
??_7ScrollItemProvider@DirectUI@@6BRefcountBase@1@@	855	0x1400342c8
??_7ScrollItemProxy@DirectUI@@6B@	856	0x14003a7e4
??_7ScrollProvider@DirectUI@@6B@	857	0x140018364
??_7ScrollProvider@DirectUI@@6BIProvider@1@@	858	0x14001268c
??_7ScrollProvider@DirectUI@@6BRefcountBase@1@@	859	0x14001e1cc
??_7ScrollProxy@DirectUI@@6B@	860	0x140005d9c
??_7ScrollViewer@DirectUI@@6BElement@1@@	861	0x1400172a8
??_7ScrollViewer@DirectUI@@6BIElementListener@1@@	862	0x140024a24
??_7SelectionItemProvider@DirectUI@@6B@	863	0x140032edc
??_7SelectionItemProvider@DirectUI@@6BIProvider@1@@	864	0x1400389c4
??_7SelectionItemProvider@DirectUI@@6BRefcountBase@1@@	865	0x140004e5c
??_7SelectionItemProxy@DirectUI@@6B@	866	0x14001de38
??_7SelectionProvider@DirectUI@@6B@	867	0x140014108
??_7SelectionProvider@DirectUI@@6BIProvider@1@@	868	0x1400224cc
??_7SelectionProvider@DirectUI@@6BRefcountBase@1@@	869	0x1400061a8
??_7SelectionProxy@DirectUI@@6B@	870	0x140025454
??_7Selector@DirectUI@@6B@	871	0x14002ac40
??_7SelectorNoDefault@DirectUI@@6B@	872	0x140040f7c
??_7SelectorSelectionItemProxy@DirectUI@@6B@	873	0x140015e20
??_7SelectorSelectionProxy@DirectUI@@6B@	874	0x140017388
??_7ShellBorderLayout@DirectUI@@6B@	875	0x140030624
??_7StyleSheet@DirectUI@@6B@	876	0x14002bca8
??_7StyledScrollViewer@DirectUI@@6BElement@1@@	877	0x140037f1c
??_7StyledScrollViewer@DirectUI@@6BIElementListener@1@@	878	0x14000e8e0
??_7Surface@DirectUI@@6B@	879	0x140021688
??_7TableItemProvider@DirectUI@@6B@	880	0x14001d2fc
??_7TableItemProvider@DirectUI@@6BIProvider@1@@	881	0x1400378e8
??_7TableItemProvider@DirectUI@@6BRefcountBase@1@@	882	0x14001a894
??_7TableItemProxy@DirectUI@@6B@	883	0x14000fc2c
??_7TableLayout@DirectUI@@6B@	884	0x140036644
??_7TableProvider@DirectUI@@6B@	885	0x14002c444
??_7TableProvider@DirectUI@@6BIProvider@1@@	886	0x140031428
??_7TableProvider@DirectUI@@6BRefcountBase@1@@	887	0x14002b3a8
??_7TableProxy@DirectUI@@6B@	888	0x140004374
??_7TaskPage@DirectUI@@6BIElementListener@1@@	889	0x14003df48
??_7TaskPage@DirectUI@@6BIXProviderCP@1@@	890	0x1400062c8
??_7TextGraphic@DirectUI@@6B@	891	0x1400142f0
??_7Thumb@DirectUI@@6B@	892	0x140014360
??_7ToggleProvider@DirectUI@@6B@	893	0x14000ede8
??_7ToggleProvider@DirectUI@@6BIProvider@1@@	894	0x14002fdcc
??_7ToggleProvider@DirectUI@@6BRefcountBase@1@@	895	0x14002f364
??_7ToggleProxy@DirectUI@@6B@	896	0x14003def0
??_7UnknownElement@DirectUI@@6B@	897	0x14001b678
??_7ValueProvider@DirectUI@@6B@	898	0x140023570
??_7ValueProvider@DirectUI@@6BIProvider@1@@	899	0x14003f9c4
??_7ValueProvider@DirectUI@@6BRefcountBase@1@@	900	0x140009b78
??_7ValueProxy@DirectUI@@6B@	901	0x140005fb8
??_7VerticalFlowLayout@DirectUI@@6B@	902	0x140012a08
??_7Viewer@DirectUI@@6B@	903	0x1400084ec
??_7XBaby@DirectUI@@6B@	904	0x14001df30
??_7XBaby@DirectUI@@6BHWNDElement@1@@	905	0x140032320
??_7XBaby@DirectUI@@6BIDialogElement@1@@	906	0x140004e68
??_7XBaby@DirectUI@@6BIElementListener@1@@	907	0x140021c8c
??_7XElement@DirectUI@@6BHWNDHost@1@@	908	0x140023ffc
??_7XElement@DirectUI@@6BIXElementCP@1@@	909	0x14003c938
??_7XProvider@DirectUI@@6B@	910	0x14002a8a0
??_7XResourceProvider@DirectUI@@6B@	911	0x140025674
??_FCCBase@DirectUI@@QEAAXXZ	912	0x14002184c
??_FCCBaseScrollBar@DirectUI@@QEAAXXZ	913	0x14000522c
??_FCCCheckBox@DirectUI@@QEAAXXZ	914	0x1400399d8
??_FCCCommandLink@DirectUI@@QEAAXXZ	915	0x14000b6e4
??_FCCPushButton@DirectUI@@QEAAXXZ	916	0x14002c9ac
??_FCCTreeView@DirectUI@@QEAAXXZ	917	0x14003839c
?AbsorbsShortcutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	918	0x140019594
?AccDefActionProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	919	0x1400275d0
?AccDescProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	920	0x14002f4c4
?AccHelpProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	921	0x1400173fc
?AccItemStatusProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	922	0x140008168
?AccItemTypeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	923	0x14002708c
?AccNameProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	924	0x14001f87c
?AccNavigate@DuiAccessible@DirectUI@@SAJPEAVElement@2@JPEAPEAV32@@Z	925	0x1400337b8
?AccRoleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	926	0x140013064
?AccStateProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	927	0x140003f24
?AccValueProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	928	0x140002c60
?AcceleratorKeyProperty@Schema@DirectUI@@2HA	929	0x1400224e4
?Access@?$SafeArrayAccessor@H@DirectUI@@QEAAJPEAUtagSAFEARRAY@@G@Z	930	0x14002f380
?AccessKeyProperty@Schema@DirectUI@@2HA	931	0x14000bf14
?AccessibleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	932	0x140015274
?ActionInitiated@Navigator@DirectUI@@SA?AVUID@@XZ	933	0x1400084d4
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z	934	0x1400187a4
?ActivateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z	935	0x14001c678
?ActivateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@K@Z	936	0x14003d674
?ActiveProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	937	0x140015678
?ActiveStateChanged@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	938	0x14003eb70
?ActualReferencePointProp@RefPointElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	939	0x1400223e0
?Add@BaseScrollViewer@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	940	0x14002893c
?Add@Element@DirectUI@@QEAAJPEAV12@@Z	941	0x140038c54
?Add@Element@DirectUI@@QEAAJPEAV12@P6AHPEBX1@Z@Z	942	0x140008640
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z	943	0x140023d98
?Add@ElementProviderManager@DirectUI@@SAJPEAVElementProvider@2@@Z	944	0x14001abc8
?Add@Expando@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	945	0x14000c674
?Add@LinkedList@DirectUI@@QEAAXPEAVLinkedListNode@2@@Z	946	0x14001ad30
?Add@Macro@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	947	0x1400050e0
?Add@Pages@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	948	0x140021568
?Add@TouchEdit2@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	949	0x1400347a0
?Add@TouchSelect@DirectUI@@UEAAJPEAPEAVElement@2@I@Z	950	0x140026b3c
?AddBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z	951	0x140039da0
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ	952	0x1400254e8
?AddChildren@ScrollViewer@DirectUI@@MEAAJXZ	953	0x14000e9b4
?AddChildren@StyledScrollViewer@DirectUI@@MEAAJXZ	954	0x140023764
?AddElement@TouchSelect@DirectUI@@QEAAJPEAVElement@2@PEBG@Z	955	0x14000ab38
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z	956	0x1400125a8
?AddRectangleChange@EventManager@DirectUI@@CAJPEAVElement@2@_N1@Z	957	0x140033764
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ	958	0x140010c30
?AddRef@DuiAccessible@DirectUI@@UEAAKXZ	959	0x140019558
?AddRef@Element@DirectUI@@QEAAKXZ	960	0x140016668
?AddRef@ElementProvider@DirectUI@@UEAAKXZ	961	0x14000eda4
?AddRef@ExpandCollapseProvider@DirectUI@@UEAAKXZ	962	0x14001e9fc
?AddRef@GridItemProvider@DirectUI@@UEAAKXZ	963	0x14000ff34
?AddRef@GridProvider@DirectUI@@UEAAKXZ	964	0x140001150
?AddRef@HWNDElementProvider@DirectUI@@UEAAKXZ	965	0x14002ae2c
?AddRef@InvokeProvider@DirectUI@@UEAAKXZ	966	0x1400410d4
?AddRef@RangeValueProvider@DirectUI@@UEAAKXZ	967	0x140023e50
?AddRef@RefcountBase@DirectUI@@QEAAJXZ	968	0x14000dbc0
?AddRef@ScrollItemProvider@DirectUI@@UEAAKXZ	969	0x140014194
?AddRef@ScrollProvider@DirectUI@@UEAAKXZ	970	0x1400105b8
?AddRef@SelectionItemProvider@DirectUI@@UEAAKXZ	971	0x14002dcc8
?AddRef@SelectionProvider@DirectUI@@UEAAKXZ	972	0x140009fe4
?AddRef@TableItemProvider@DirectUI@@UEAAKXZ	973	0x14000d684
?AddRef@TableProvider@DirectUI@@UEAAKXZ	974	0x140028660
?AddRef@ToggleProvider@DirectUI@@UEAAKXZ	975	0x140016f70
?AddRef@Value@DirectUI@@QEAAXXZ	976	0x140033da0
?AddRef@ValueProvider@DirectUI@@UEAAKXZ	977	0x14002b1dc
?AddRef@XProvider@DirectUI@@UEAAKXZ	978	0x140022670
?AddRulesToStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAVStyleSheet@2@PEBGPEAV?$DynamicArray@UXMLParserCond@DirectUI@@$0A@@2@PEAV?$DynamicArray@PEAG$0A@@2@@Z	979	0x14002be68
?AddString@CCListBox@DirectUI@@QEAAHPEBG@Z	980	0x14000225c
?AddString@Combobox@DirectUI@@QEAAHPEBG@Z	981	0x14000f8f4
?AddString@TouchSelect@DirectUI@@QEAAJPEBG@Z	982	0x14003dc34
?AddString@TouchSelect@DirectUI@@QEAAJPEBGPEAPEAVElement@2@@Z	983	0x14000583c
?AddStringWithLabelOverride@TouchSelect@DirectUI@@QEAAJPEBG0PEAPEAVElement@2@@Z	984	0x140006628
?AddToSelection@NavigatorSelectionItemProxy@DirectUI@@AEAAJPEAVBrowser@2@@Z	985	0x14000a408
?AddToSelection@SelectionItemProvider@DirectUI@@UEAAJXZ	986	0x140037db8
?AddToSelection@SelectorSelectionItemProxy@DirectUI@@AEAAJXZ	987	0x14002cb6c
?AdvanceFrame@AnimationStrip@DirectUI@@IEAAXXZ	988	0x14001400c
?AdvanceFrame@Movie@DirectUI@@SA?AVUID@@XZ	989	0x140010d3c
?AdviseEventAdded@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z	990	0x140018eb4
?AdviseEventAdded@EventManager@DirectUI@@SAJHPEAUtagSAFEARRAY@@@Z	991	0x140023720
?AdviseEventRemoved@ElementProvider@DirectUI@@UEAAJHPEAUtagSAFEARRAY@@@Z	992	0x14002384c
?AdviseEventRemoved@EventManager@DirectUI@@SAJHPEAUtagSAFEARRAY@@@Z	993	0x14003da60
?AliasedRenderingProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	994	0x1400309ac
?AlphaProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	995	0x140034518
?AnimatePopupOnDismissProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	996	0x14002cc08
?AnimateScroll@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	997	0x140039d8c
?AnimationChange@Element@DirectUI@@SA?AVUID@@XZ	998	0x14003c2bc
?AnimationProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	999	0x140003fb0
?AnimationStatusChange@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1000	0x14002aacc
?ApplySinkRegion@HWNDHost@DirectUI@@AEAAXPEBUtagRECT@@_N@Z	1001	0x14000e4c8
?Arrow@Expando@DirectUI@@KAGXZ	1002	0x1400046fc
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ	1003	0x1400034a8
?AsyncContentLoadedEvent@Schema@DirectUI@@2HA	1004	0x140037c7c
?Attach@Layout@DirectUI@@UEAAXPEAVElement@2@@Z	1005	0x140023fb8
?AttachCtrlSubclassProc@HWNDHost@DirectUI@@KAXPEAUHWND__@@@Z	1006	0x140029964
?AutoGroupingProp@CCRadioButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1007	0x14002f61c
?AutoStartProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1008	0x14003c9b0
?AutoStopProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1009	0x14003dab0
?AutomationFocusChangedEvent@Schema@DirectUI@@2HA	1010	0x14000b740
?AutomationIdProperty@Schema@DirectUI@@2HA	1011	0x1400020f4
?AutomationPropertyChangedEvent@Schema@DirectUI@@2HA	1012	0x140005624
?BackgroundOwnerIDProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	1013	0x140014dc0
?BackgroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1014	0x140023edc
?BaselineProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1015	0x14003b36c
?BorderColorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1016	0x14002ff10
?BorderStyleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1017	0x140017628
?BorderThicknessProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1018	0x1400305f8
?BoundingRectangleProperty@Schema@DirectUI@@2HA	1019	0x140010040
?BroadcastEvent@Element@DirectUI@@QEAAXPEAUEvent@2@@Z	1020	0x140030ff0
?BufferingProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	1021	0x14000ab98
?BuildCacheInfo@FlowLayout@DirectUI@@IEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@_N@Z	1022	0x14002cf78
?BuildCacheInfo@VerticalFlowLayout@DirectUI@@IEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@_N@Z	1023	0x1400091e4
?BuildElement@Macro@DirectUI@@MEAAJXZ	1024	0x140020110
?BuildElement@Repeater@DirectUI@@MEAAJXZ	1025	0x140012664
?ButtonClassAcceptsEnterKeyProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	1026	0x140027930
?ButtonControlType@Schema@DirectUI@@2HA	1027	0x14002fc94
?CacheParser@XBaby@DirectUI@@UEAAXPEAVDUIXmlParser@2@@Z	1028	0x14002dbec
?CalendarControlType@Schema@DirectUI@@2HA	1029	0x14001b78c
?CanPerformManualVisualSwap@TouchScrollViewer@DirectUI@@QEAA_NXZ	1030	0x140014aac
?CanSetFocus@HWNDElement@DirectUI@@UEAA_NXZ	1031	0x140003dc4
?CanSetFocus@XBaby@DirectUI@@UEAA_NXZ	1032	0x14002f0a0
?CanSetFocus@XProvider@DirectUI@@UEAAJPEA_N@Z	1033	0x1400125f4
?CancelClick@TouchButton@DirectUI@@QEAA_NW4ClickDevice@12@@Z	1034	0x140023d40
?CancelCurrentDrag@TouchSlider@DirectUI@@QEAAXXZ	1035	0x1400147ac
?CaptureCallstackFrames@CallstackTracker@DirectUI@@QEAAHXZ	1036	0x140014bdc
?CapturedProp@Button@DirectUI@@SAPEBUPropertyInfo@2@XZ	1037	0x140008f68
?CapturedProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1038	0x14000807c
?CaretMoved@TouchEditBase@DirectUI@@SA?AVUID@@XZ	1039	0x14001884c
?CheckBoxControlType@Schema@DirectUI@@2HA	1040	0x14003cd2c
?CheckScroll@BaseScrollViewer@DirectUI@@AEAAXPEAVBaseScrollBar@2@HHH@Z	1041	0x140003274
?CheckedStateProp@TouchCheckBox@DirectUI@@SAPEBUPropertyInfo@2@XZ	1042	0x14000b930
?ChildrenProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1043	0x140005100
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z	1044	0x140003778
?ClassNameProperty@Schema@DirectUI@@2HA	1045	0x14000ce6c
?ClassProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1046	0x14001ecf8
?ClearButtonClicked@TouchEdit2@DirectUI@@SA?AVUID@@XZ	1047	0x14000d610
?ClearCacheDirty@Layout@DirectUI@@IEAAXXZ	1048	0x140031d1c
?ClearParser@DUIFactory@DirectUI@@AEAAXXZ	1049	0x1400363e0
?Click@Button@DirectUI@@SA?AVUID@@XZ	1050	0x140006c80
?Click@TouchButton@DirectUI@@SA?AVUID@@XZ	1051	0x14000e178
?ClickDefaultButton@DialogElement@DirectUI@@UEAA_NXZ	1052	0x140017294
?ClickDefaultButton@DialogElementCore@DirectUI@@QEAA_NXZ	1053	0x14000a69c
?ClickDefaultButton@XBaby@DirectUI@@UEAA_NXZ	1054	0x14001036c
?ClickDefaultButton@XProvider@DirectUI@@UEAAHXZ	1055	0x1400033a4
?ClickablePointProperty@Schema@DirectUI@@2HA	1056	0x1400410a4
?Clipper@Expando@DirectUI@@KAGXZ	1057	0x140022938
?Clone@DuiAccessible@DirectUI@@UEAAJPEAPEAUIEnumVARIANT@@@Z	1058	0x14000da24
?Clone@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAUIEnumVARIANT@@@Z	1059	0x140017a7c
?Close@ElementProviderManager@DirectUI@@SAXXZ	1060	0x14001d0ec
?Close@EventManager@DirectUI@@SAXXZ	1061	0x140030150
?Close@InvokeManager@DirectUI@@SAXXZ	1062	0x14002b0d4
?ClosePopup@TouchSelect@DirectUI@@QEAAXXZ	1063	0x140023dec
?CloseThread@InvokeManager@DirectUI@@SAXXZ	1064	0x140001678
?Collapse@ExpandCollapseProvider@DirectUI@@UEAAJXZ	1065	0x14003fec8
?ColorFontPaletteIndexProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1066	0x140034468
?ComboBoxControlType@Schema@DirectUI@@2HA	1067	0x14000a158
?CompositedTextProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1068	0x14000560c
?CompositingQualityProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1069	0x14003f6e4
?CompositionChange@HWNDElement@DirectUI@@SA?AVUID@@XZ	1070	0x14001148c
?ConnectProp@Bind@DirectUI@@SAPEBUPropertyInfo@2@XZ	1071	0x14003900c
?ConstrainLayoutProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1072	0x14003f4d4
?ContentAlignProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1073	0x140035dd4
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1074	0x14003f874
?Context@Button@DirectUI@@SA?AVUID@@XZ	1075	0x140011ef8
?ContextMenuHintShowing@ContextMenuBehavior@DirectUI@@SA?AVUID@@XZ	1076	0x140021ea8
?ContextMenuRequested@ContextMenuBehavior@DirectUI@@SA?AVUID@@XZ	1077	0x140016704
?ContextMenuRequested@TouchEdit2@DirectUI@@SA?AVUID@@XZ	1078	0x14003a980
?ContextSensitiveHelp@DuiAccessible@DirectUI@@UEAAJH@Z	1079	0x1400094f8
?ContextSensitiveHelp@HWNDHostAccessible@DirectUI@@UEAAJH@Z	1080	0x14001c76c
?ControlTypeProperty@Schema@DirectUI@@2HA	1081	0x140029c30
?CopySheets@DUIXmlParser@DirectUI@@QEAAJPEAPEAV?$DynamicArray@PEAVValue@DirectUI@@$0A@@2@@Z	1082	0x1400362c0
?Count@?$SafeArrayAccessor@H@DirectUI@@QEAAHXZ	1083	0x140013b04
?Create@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1084	0x140035ca0
?Create@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1085	0x140016950
?Create@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1086	0x140020918
?Create@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1087	0x14000cbb8
?Create@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1088	0x14002c0d4
?Create@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1089	0x140031ce0
?Create@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1090	0x140004b1c
?Create@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1091	0x14000bdf4
?Create@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1092	0x1400246d4
?Create@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1093	0x14003f5a4
?Create@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1094	0x140023fc8
?Create@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1095	0x1400049f0
?Create@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@SAJPEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1096	0x14000396c
?Create@AcceleratorBehavior@@SAJPEAPEAUIDuiBehavior@@@Z	1097	0x14000ce54
?Create@AccessibleButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1098	0x140017fb4
?Create@AnimationStrip@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1099	0x1400016e0
?Create@AutoButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1100	0x140012938
?Create@Bind@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1101	0x140029498
?Create@BorderLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1102	0x140004c8c
?Create@BorderLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1103	0x14003d710
?Create@Browser@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1104	0x14003e4f4
?Create@Button@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1105	0x14002be20
?Create@Button@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1106	0x14002a148
?Create@CCAVI@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1107	0x140034700
?Create@CCAVI@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1108	0x14002e51c
?Create@CCBase@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1109	0x1400361bc
?Create@CCBase@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1110	0x140024890
?Create@CCCheckBox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1111	0x140031d68
?Create@CCCheckBox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1112	0x14002bd40
?Create@CCCommandLink@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1113	0x140032d90
?Create@CCCommandLink@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1114	0x14001743c
?Create@CCHScrollBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1115	0x14002c358
?Create@CCHScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1116	0x1400303a0
?Create@CCListBox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1117	0x140010cf4
?Create@CCListBox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1118	0x14003d6f8
?Create@CCListView@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1119	0x140025f1c
?Create@CCListView@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1120	0x14001a95c
?Create@CCProgressBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1121	0x140032c44
?Create@CCProgressBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1122	0x1400112e8
?Create@CCPushButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1123	0x14000ca90
?Create@CCPushButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1124	0x140012404
?Create@CCRadioButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1125	0x1400010f4
?Create@CCRadioButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1126	0x14001b018
?Create@CCSysLink@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1127	0x1400386bc
?Create@CCSysLink@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1128	0x140012fc8
?Create@CCTrackBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1129	0x14001a4e8
?Create@CCTrackBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1130	0x14002128c
?Create@CCTreeView@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1131	0x14002ed48
?Create@CCTreeView@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1132	0x140028fd0
?Create@CCVScrollBar@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1133	0x14002df2c
?Create@CCVScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1134	0x1400127dc
?Create@CheckBoxGlyph@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1135	0x1400036ec
?Create@CheckBoxGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1136	0x14001cc70
?Create@Clipper@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1137	0x1400022a4
?Create@Combobox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1138	0x140003a2c
?Create@Combobox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1139	0x14003d68c
?Create@ContextMenuBehavior@DirectUI@@SAJPEAPEAUIDuiBehavior@@@Z	1140	0x140041518
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z	1141	0x140018b08
?Create@DialogElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z	1142	0x140032408
?Create@DuiAccessible@DirectUI@@SAJPEAVElement@2@PEAPEAV12@@Z	1143	0x1400416d0
?Create@Edit@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1144	0x14001ab38
?Create@Edit@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1145	0x14000d050
?Create@Element@DirectUI@@SAJIPEAV12@PEAKPEAPEAV12@@Z	1146	0x140020a44
?Create@ElementProvider@DirectUI@@SAJPEAVElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z	1147	0x14000e6c0
?Create@ElementProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1148	0x14000b224
?Create@ElementWithHWND@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1149	0x1400194dc
?Create@ExpandCollapseProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1150	0x14002ea64
?Create@Expandable@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1151	0x14000a140
?Create@Expando@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1152	0x140020914
?Create@ExpandoButtonGlyph@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1153	0x140018d2c
?Create@ExpandoButtonGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1154	0x140010244
?Create@FillLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1155	0x14002ace4
?Create@FillLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1156	0x14001b830
?Create@FlowLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1157	0x140027204
?Create@FlowLayout@DirectUI@@SAJ_NIIIPEAPEAVLayout@2@@Z	1158	0x14002bc70
?Create@GridItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1159	0x1400373b8
?Create@GridLayout@DirectUI@@SAJHHPEAPEAVLayout@2@@Z	1160	0x14002f914
?Create@GridLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1161	0x14000ecd4
?Create@GridProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1162	0x140002080
?Create@HWNDElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z	1163	0x140011860
?Create@HWNDElementAccessible@DirectUI@@SAJPEAVHWNDElement@2@PEAPEAVDuiAccessible@2@@Z	1164	0x14001b7a8
?Create@HWNDElementProvider@DirectUI@@SAJPEAVHWNDElement@2@PEAVInvokeHelper@2@PEAPEAV12@@Z	1165	0x14003e25c
?Create@HWNDElementProxy@DirectUI@@SAPEAV12@PEAVHWNDElement@2@@Z	1166	0x14001df08
?Create@HWNDHost@DirectUI@@SAJIIPEAVElement@2@PEAKPEAPEAV32@@Z	1167	0x140021a58
?Create@HWNDHost@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1168	0x14003887c
?Create@HWNDHostAccessible@DirectUI@@SAJPEAVElement@2@PEAUIAccessible@@PEAPEAVDuiAccessible@2@@Z	1169	0x1400288bc
?Create@HWNDHostClientAccessible@DirectUI@@SAJPEAVElement@2@PEAUIAccessible@@PEAPEAVDuiAccessible@2@@Z	1170	0x14003cf9c
?Create@InvokeProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1171	0x14003a15c
?Create@ItemList@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1172	0x14001cb1c
?Create@Layout@DirectUI@@SAJPEAPEAV12@@Z	1173	0x1400157e0
?Create@Macro@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1174	0x140013040
?Create@ModernProgressBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1175	0x14003ab94
?Create@ModernProgressRing@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1176	0x1400137a8
?Create@Movie@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1177	0x140039560
?Create@Movie@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1178	0x14002ee50
?Create@NativeHWNDHost@DirectUI@@SAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@IPEAPEAV12@@Z	1179	0x14001f5fc
?Create@NativeHWNDHost@DirectUI@@SAJPEBGPEAUHWND__@@PEAUHICON__@@HHHHHHIPEAPEAV12@@Z	1180	0x1400240b4
?Create@Navigator@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1181	0x140017248
?Create@NineGridLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1182	0x14001a8b8
?Create@NineGridLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1183	0x14001c6a8
?Create@PText@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1184	0x140033884
?Create@Page@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1185	0x14002d4b8
?Create@Pages@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1186	0x140033dbc
?Create@Progress@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1187	0x140009160
?Create@PushButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1188	0x1400046b8
?Create@RadioButtonGlyph@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1189	0x140010900
?Create@RadioButtonGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1190	0x140010600
?Create@RangeValueProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1191	0x140030b6c
?Create@RefPointElement@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1192	0x14002105c
?Create@RefPointElement@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1193	0x14001b224
?Create@RepeatButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1194	0x140018a7c
?Create@RepeatButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1195	0x140026bbc
?Create@Repeater@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1196	0x140037150
?Create@RichText@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1197	0x140018600
?Create@RowLayout@DirectUI@@SAJHIIPEAPEAVLayout@2@@Z	1198	0x140030e94
?Create@RowLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1199	0x140024df8
?Create@RowLayout@DirectUI@@SAJIIPEAPEAVLayout@2@@Z	1200	0x14001d70c
?Create@ScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1201	0x1400063cc
?Create@ScrollBar@DirectUI@@SAJ_NPEAVElement@2@PEAKPEAPEAV32@@Z	1202	0x14002fd38
?Create@ScrollItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1203	0x1400350e4
?Create@ScrollProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1204	0x1400341e0
?Create@ScrollViewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1205	0x140014afc
?Create@ScrubBehavior@@SAJPEAPEAUIDuiBehavior@@@Z	1206	0x140007024
?Create@SelectionItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1207	0x14002f2b4
?Create@SelectionProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1208	0x14000bbd0
?Create@Selector@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1209	0x1400389fc
?Create@SelectorNoDefault@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1210	0x14000c338
?Create@SemanticZoomToggle@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1211	0x140032da0
?Create@ShellBorderLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1212	0x140003308
?Create@ShellBorderLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z	1213	0x14003e3c0
?Create@StyleSheet@DirectUI@@SAJPEAPEAV12@@Z	1214	0x140019c68
?Create@StyledScrollViewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1215	0x1400352ac
?Create@TableItemProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1216	0x140035658
?Create@TableLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1217	0x140017374
?Create@TableProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1218	0x14001bcfc
?Create@TextGraphic@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1219	0x14003bc58
?Create@Thumb@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1220	0x140009ed4
?Create@Thumb@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1221	0x14000a680
?Create@ToggleProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1222	0x140007b68
?Create@TouchButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1223	0x140040d0c
?Create@TouchButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1224	0x14000dbf8
?Create@TouchCheckBox@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1225	0x140014d78
?Create@TouchCheckBox@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1226	0x140040ccc
?Create@TouchCheckBoxGlyph@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1227	0x14002e1bc
?Create@TouchCommandButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1228	0x14001b0dc
?Create@TouchCommandButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1229	0x1400209a8
?Create@TouchEdit2@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1230	0x140014070
?Create@TouchEditBase@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1231	0x140034620
?Create@TouchHWNDElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z	1232	0x140037014
?Create@TouchHyperLink@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1233	0x14000121c
?Create@TouchHyperLink@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1234	0x140020738
?Create@TouchRepeatButton@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1235	0x14003c470
?Create@TouchRepeatButton@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1236	0x140013124
?Create@TouchScrollBar@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1237	0x140034de4
?Create@TouchScrollViewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1238	0x1400153a4
?Create@TouchSelect@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1239	0x14003b7e4
?Create@TouchSelectItem@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1240	0x140012eb8
?Create@TouchSlider@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1241	0x14003dcf4
?Create@TouchSwitch@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1242	0x1400185d0
?Create@UnknownElement@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1243	0x14000a0f8
?Create@UnknownElement@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1244	0x14000a390
?Create@ValueProxy@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1245	0x140035afc
?Create@VerticalFlowLayout@DirectUI@@SAJHPEAHPEAPEAVValue@2@@Z	1246	0x140016458
?Create@VerticalFlowLayout@DirectUI@@SAJ_NIIIPEAPEAVLayout@2@@Z	1247	0x1400356ac
?Create@Viewer@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1248	0x140017638
?Create@XBaby@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1249	0x140005c90
?Create@XBaby@DirectUI@@SAJPEAVIXElementCP@2@PEAVXProvider@2@PEAUHWND__@@PEAVElement@2@PEAKPEAPEAV62@@Z	1250	0x140037df4
?Create@XElement@DirectUI@@SAJIPEAVElement@2@PEAKPEAPEAV32@@Z	1251	0x1400243b0
?Create@XElement@DirectUI@@SAJPEAVElement@2@PEAKPEAPEAV32@@Z	1252	0x14000f78c
?Create@XHost@DirectUI@@SAJPEAVIXElementCP@2@PEAPEAV12@@Z	1253	0x1400322e4
?Create@XProvider@DirectUI@@SAJPEAVElement@2@PEAVIXProviderCP@2@PEAPEAV12@@Z	1254	0x1400120f0
?Create@XResourceProvider@DirectUI@@SAJPEAPEAV12@@Z	1255	0x140028df4
?Create@XResourceProvider@DirectUI@@SAJPEAUHINSTANCE__@@PEBG11PEAPEAV12@@Z	1256	0x1400304a4
?CreateAccNameLabel@HWNDHost@DirectUI@@IEAAPEAUHWND__@@PEAU3@@Z	1257	0x140025fb4
?CreateAtom@Value@DirectUI@@SAPEAV12@G@Z	1258	0x140013fe0
?CreateAtom@Value@DirectUI@@SAPEAV12@PEBG@Z	1259	0x14001f3c0
?CreateBool@Value@DirectUI@@SAPEAV12@_N@Z	1260	0x1400416b0
?CreateButtons@ScrollBar@DirectUI@@MEAAJXZ	1261	0x140014bec
?CreateButtons@TouchScrollBar@DirectUI@@UEAAJXZ	1262	0x140034f7c
?CreateCache@RichText@DirectUI@@SAJIPEAPEAUIDUIRichTextCache@@@Z	1263	0x140026ec8
?CreateColor@Value@DirectUI@@SAPEAV12@K@Z	1264	0x140002258
?CreateColor@Value@DirectUI@@SAPEAV12@KKE@Z	1265	0x14002e9f8
?CreateColor@Value@DirectUI@@SAPEAV12@KKKE@Z	1266	0x14002e6dc
?CreateCursor@Value@DirectUI@@SAPEAV12@PEAUHICON__@@@Z	1267	0x14002c5e0
?CreateCursor@Value@DirectUI@@SAPEAV12@PEBG@Z	1268	0x14001eab4
?CreateDFCFill@Value@DirectUI@@SAPEAV12@II@Z	1269	0x14002e128
?CreateDTBFill@Value@DirectUI@@SAPEAV12@PEBGHH@Z	1270	0x140007c84
?CreateDUI@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAPEAUHWND__@@@Z	1271	0x140028014
?CreateDUICP@TaskPage@DirectUI@@EEAAJPEAVHWNDElement@2@PEAUHWND__@@1PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z	1272	0x14003da48
?CreateDUICP@XResourceProvider@DirectUI@@UEAAJPEAVHWNDElement@2@PEAUHWND__@@1PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z	1273	0x14001e584
?CreateDoubleList@Value@DirectUI@@SAPEAV12@PEAV?$DynamicArray@N$0A@@2@@Z	1275	0x140001310
?CreateDoubleList@Value@DirectUI@@SAPEAV12@PEBNH@Z	1276	0x14000c160
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z	1277	0x14003ff80
?CreateElementList@Value@DirectUI@@SAPEAV12@PEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@@Z	1278	0x14000fe38
?CreateElementRef@Value@DirectUI@@SAPEAV12@PEAVElement@2@@Z	1279	0x14003e4e4
?CreateElementScaledValue@Value@DirectUI@@SAPEAV12@PEAVElement@2@PEAV12@@Z	1280	0x140022478
?CreateEncodedString@Value@DirectUI@@SAPEAV12@PEBG@Z	1281	0x140029d64
?CreateExpression@Value@DirectUI@@SAPEAV12@PEAVExpression@2@@Z	1282	0x14000df0c
?CreateFill@Value@DirectUI@@SAPEAV12@AEBUFill@2@@Z	1283	0x140010384
?CreateFloat@Value@DirectUI@@SAPEAV12@MW4DynamicScaleValue@@@Z	1284	0x140024224
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHBITMAP__@@EI_N11@Z	1285	0x140018b64
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHENHMETAFILE__@@0@Z	1286	0x140007f8c
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHICON__@@_N11@Z	1287	0x1400328cc
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUISharedBitmap@@EI@Z	1288	0x14003a764
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEBGEIGGPEAUHINSTANCE__@@_N2@Z	1289	0x14003b264
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEBGGGPEAUHINSTANCE__@@_N2@Z	1290	0x140015b28
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEBGUScaledSIZE@2@PEAUHINSTANCE__@@_N3@Z	1291	0x140004e7c
?CreateHWND@CCBase@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1292	0x140003f18
?CreateHWND@CCBaseScrollBar@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1293	0x140011e80
?CreateHWND@Combobox@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1294	0x14000af90
?CreateHWND@Edit@DirectUI@@MEAAPEAUHWND__@@PEAU3@@Z	1295	0x14000f684
?CreateHWND@Edit@DirectUI@@MEAAPEAUHWND__@@PEAU3@_N@Z	1296	0x14001bcf0
?CreateHWND@HWNDHost@DirectUI@@MEAAPEAUHWND__@@PEAU3@@Z	1297	0x140024730
?CreateHWND@XElement@DirectUI@@UEAAPEAUHWND__@@PEAU3@@Z	1298	0x14003c65c
?CreateHostWindow@NativeHWNDHost@DirectUI@@UEAAPEAUHWND__@@KPEBG0KHHHHPEAU3@PEAUHMENU__@@PEAUHINSTANCE__@@PEAX@Z	1299	0x14003f51c
?CreateIconGraphicHelper@Value@DirectUI@@CAPEAV12@PEAUHICON__@@_N11@Z	1300	0x14001c8fc
?CreateInstance@CSafeElementProxy@@SAJPEAVElement@DirectUI@@PEAPEAV1@@Z	1301	0x14000b37c
?CreateInt@Value@DirectUI@@SAPEAV12@HW4DynamicScaleValue@@@Z	1302	0x1400030e8
?CreateLayout@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@P6AJHPEAHPEAPEAVValue@2@@Z@Z	1303	0x14001a8a0
?CreateLayout@Value@DirectUI@@SAPEAV12@PEAVLayout@2@@Z	1304	0x140039460
?CreateParser@DUIFactory@DirectUI@@QEAAJXZ	1305	0x1400291f4
?CreateParser@XProvider@DirectUI@@QEAAJPEAPEAVDUIXmlParser@2@@Z	1306	0x14000e030
?CreateParserCP@TaskPage@DirectUI@@EEAAJPEAPEAVDUIXmlParser@2@@Z	1307	0x14002e8b4
?CreateParserCP@XResourceProvider@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z	1308	0x140036d98
?CreatePatternProvider@Schema@DirectUI@@SAJW4Pattern@12@PEAVElementProvider@2@PEAPEAUIUnknown@@@Z	1309	0x14001ca58
?CreatePoint@Value@DirectUI@@SAPEAV12@HHW4DynamicScaleValue@@@Z	1310	0x140034f38
?CreateRect@Value@DirectUI@@SAPEAV12@HHHHW4DynamicScaleValue@@@Z	1311	0x140036304
?CreateScaledValue@Value@DirectUI@@SAPEAV12@MPEAV12@@Z	1312	0x140033060
?CreateScrollBars@ScrollViewer@DirectUI@@MEAAJXZ	1313	0x14001c1b4
?CreateScrollBars@StyledScrollViewer@DirectUI@@MEAAJXZ	1314	0x14001fe0c
?CreateSize@Value@DirectUI@@SAPEAV12@HHW4DynamicScaleValue@@@Z	1315	0x140014124
?CreateString@Value@DirectUI@@SAPEAV12@PEBGPEAUHINSTANCE__@@@Z	1316	0x140038c14
?CreateStringRP@Value@DirectUI@@SAPEAV12@PEBGPEAUHINSTANCE__@@@Z	1317	0x140025f60
?CreateStyleParser@HWNDElement@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z	1318	0x140029f5c
?CreateStyleParser@XBaby@DirectUI@@UEAAJPEAPEAVDUIXmlParser@2@@Z	1319	0x14000db64
?CreateStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBGPEAPEAVStyleSheet@2@@Z	1320	0x14003a754
?CreateStyleSheet@Value@DirectUI@@SAPEAV12@PEAVStyleSheet@2@@Z	1321	0x14002a890
?CreateValueList@Value@DirectUI@@SAPEAV12@PEAV12@@Z	1322	0x14001363c
?CreateValueList@Value@DirectUI@@SAPEAV12@PEAV?$DynamicArray@PEAVValue@DirectUI@@$0A@@2@@Z	1323	0x140032698
?CreateXBaby@XProvider@DirectUI@@UEAAJPEAVIXElementCP@2@PEAUHWND__@@PEAVElement@2@PEAKPEAPEAUIXBaby@2@@Z	1324	0x14000c608
?CreateXmlReader@DUIXmlParser@DirectUI@@IEAAJPEAPEAUIXmlReader@@@Z	1325	0x14001a7e8
?CreateXmlReaderFromHGLOBAL@DUIXmlParser@DirectUI@@IEAAJPEAXPEAPEAUIXmlReader@@@Z	1326	0x140034f78
?CreateXmlReaderInputWithEncodingName@DUIXmlParser@DirectUI@@IEAAJPEAUIStream@@PEBGPEAPEAUIUnknown@@@Z	1327	0x14000ea10
?CtrlSubclassProc@HWNDHost@DirectUI@@KA_JPEAUHWND__@@I_K_J@Z	1328	0x14002f178
?CultureProperty@Schema@DirectUI@@2HA	1329	0x140038374
?CursorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1330	0x14000f2bc
?CustomControlType@Schema@DirectUI@@2HA	1331	0x14003d640
?CustomDragDropScalingHint@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1332	0x14002fbcc
?CustomProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1333	0x140027a8c
?CustomReflowHint@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1334	0x1400161e4
?CustomTapHint@PVLAnimation@DirectUI@@SA?AVUID@@XZ	1335	0x14003d17c
?Cut@TouchEditBase@DirectUI@@SA?AVUID@@XZ	1336	0x14003baa4
?DCompDeviceRebuilt@Element@DirectUI@@SA?AVUID@@XZ	1337	0x140034f28
?DPIProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1338	0x140022088
?DUICreatePropertySheetPage@TaskPage@DirectUI@@QEAAJPEAUHINSTANCE__@@@Z	1339	0x1400171b0
?DataGridControlType@Schema@DirectUI@@2HA	1340	0x1400326e0
?DataItemControlType@Schema@DirectUI@@2HA	1341	0x140003d48
?DefaultAction@Button@DirectUI@@UEAAJXZ	1342	0x140025514
?DefaultAction@CCBase@DirectUI@@UEAAJXZ	1343	0x140012d40
?DefaultAction@CCPushButton@DirectUI@@UEAAJXZ	1344	0x140009988
?DefaultAction@Element@DirectUI@@UEAAJXZ	1345	0x1400390d4
?DefaultAction@SemanticZoomToggle@DirectUI@@UEAAJXZ	1346	0x140019f5c
?DefaultAction@TouchButton@DirectUI@@UEAAJXZ	1347	0x140037348
?DefaultAction@TouchRepeatButton@DirectUI@@UEAAJXZ	1348	0x14002c178
?DefaultButtonTrackingProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	1349	0x140025a38
?DelayActivateTooltip@HWNDElement@DirectUI@@QEAAXXZ	1350	0x140014bd0
?DeleteString@CCListBox@DirectUI@@QEAAHH@Z	1351	0x14000366c
?DesiredSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1352	0x14003aa48
?Destroy@ClassInfoBase@DirectUI@@UEAAXXZ	1353	0x14001bbd0
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ	1354	0x14003a790
?Destroy@Element@DirectUI@@QEAAJ_N@Z	1355	0x140009bdc
?Destroy@Expression@DirectUI@@QEAAXXZ	1356	0x14003dfdc
?Destroy@Layout@DirectUI@@QEAAXXZ	1357	0x14001b4ac
?Destroy@NativeHWNDHost@DirectUI@@QEAAXXZ	1358	0x14001a9f0
?Destroy@XHost@DirectUI@@QEAAXXZ	1359	0x140006844
?DestroyAll@Element@DirectUI@@QEAAJ_N@Z	1360	0x140015220
?DestroyCP@TaskPage@DirectUI@@EEAAXXZ	1361	0x140024fc4
?DestroyCP@XResourceProvider@DirectUI@@UEAAXXZ	1362	0x14003ddf4
?DestroyListener@EventManager@DirectUI@@SAXPEAVElement@2@@Z	1363	0x140004df0
?DestroyMsg@NativeHWNDHost@DirectUI@@SAIXZ	1364	0x140027a54
?DestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ	1365	0x140017b20
?DestroyWindow@XHost@DirectUI@@QEAAXXZ	1366	0x140037e6c
?Detach@CSafeElementProxy@@QEAAXXZ	1367	0x14001f3b8
?Detach@Element@DirectUI@@QEAAXPEAVDeferCycle@2@@Z	1368	0x14002d784
?Detach@HWNDHost@DirectUI@@QEAAXXZ	1369	0x140012730
?Detach@Layout@DirectUI@@UEAAXPEAVElement@2@@Z	1370	0x1400097a4
?DetachParser@DUIFactory@DirectUI@@QEAAPEAVDUIXmlParser@2@XZ	1371	0x14001af28
?DeterminateProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	1372	0x14002f7a0
?DirectionProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1373	0x14000f05c
?DirtyProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	1374	0x1400039ec
?DisableAccTextExtendProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1375	0x1400361dc
?DisableMouseInRectCheckProp@TouchRepeatButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1376	0x14003fe0c
?DisableSelectionHandlesOnEmptyContent@TouchEdit2@DirectUI@@QEAAXXZ	1377	0x140040a1c
?Disconnect@DuiAccessible@DirectUI@@UEAAJXZ	1378	0x140009014
?Disconnect@HWNDElementAccessible@DirectUI@@UEAAJXZ	1379	0x140006b94
?Disconnect@HWNDHostAccessible@DirectUI@@UEAAJXZ	1380	0x14003f0e0
?DismissIHMAsync@TouchHWNDElement@DirectUI@@QEAAJXZ	1381	0x140037e24
?DllsLoaded@CallstackTracker@DirectUI@@CAHXZ	1382	0x1400303bc
?DoInvoke@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@IEAAJHZZ	1383	0x14002e3e4
?DoInvoke@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@IEAAJHZZ	1384	0x140012ef4
?DoInvoke@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@IEAAJHZZ	1385	0x1400115a8
?DoInvoke@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@IEAAJHZZ	1386	0x14004067c
?DoInvoke@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@IEAAJHZZ	1387	0x14003288c
?DoInvoke@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@IEAAJHZZ	1388	0x140030eb0
?DoInvoke@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@IEAAJHZZ	1389	0x140002728
?DoInvoke@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@IEAAJHZZ	1390	0x1400366f8
?DoInvoke@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@IEAAJHZZ	1391	0x140037a38
?DoInvoke@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@IEAAJHZZ	1392	0x140038720
?DoInvoke@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@IEAAJHZZ	1393	0x14000ffdc
?DoInvoke@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@IEAAJHZZ	1394	0x140021674
?DoInvoke@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@IEAAJHZZ	1395	0x14003203c
?DoInvoke@ElementProvider@DirectUI@@IEAAJHZZ	1396	0x140024810
?DoInvoke@InvokeHelper@DirectUI@@QEAAJHPEAVElementProvider@2@P6APEAVProviderProxy@2@PEAVElement@2@@ZPEAD@Z	1397	0x14003d7e8
?DoInvokeArgs@ElementProvider@DirectUI@@QEAAJHP6APEAVProviderProxy@2@PEAVElement@2@@ZPEAD@Z	1398	0x14001da7c
?DoLayout@BorderLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1399	0x14000a4a8
?DoLayout@FillLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1400	0x140019a04
?DoLayout@FlowLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1401	0x140007f40
?DoLayout@GridLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1402	0x140027b18
?DoLayout@Layout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1403	0x140005384
?DoLayout@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1404	0x140028308
?DoLayout@RowLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1405	0x1400232f0
?DoLayout@TableLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1406	0x140026298
?DoLayout@VerticalFlowLayout@DirectUI@@UEAAXPEAVElement@2@HH@Z	1407	0x140035230
?DoMethod@BrowserSelectionProxy@DirectUI@@UEAAJHPEAD@Z	1408	0x140021d80
?DoMethod@ElementProxy@DirectUI@@UEAAJHPEAD@Z	1409	0x14003f5d8
?DoMethod@ExpandCollapseProxy@DirectUI@@UEAAJHPEAD@Z	1410	0x140023058
?DoMethod@GridItemProxy@DirectUI@@UEAAJHPEAD@Z	1411	0x140023b98
?DoMethod@GridProxy@DirectUI@@UEAAJHPEAD@Z	1412	0x14000c460
?DoMethod@HWNDElementProxy@DirectUI@@UEAAJHPEAD@Z	1413	0x1400368b0
?DoMethod@InvokeProxy@DirectUI@@UEAAJHPEAD@Z	1414	0x1400398b4
?DoMethod@ModernProgressBarRangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1415	0x14001e898
?DoMethod@NavigatorSelectionItemProxy@DirectUI@@UEAAJHPEAD@Z	1416	0x1400328dc
?DoMethod@ProgressRangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1417	0x14002dad0
?DoMethod@RangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1418	0x14003046c
?DoMethod@ScrollBarRangeValueProxy@DirectUI@@UEAAJHPEAD@Z	1419	0x140019c58
?DoMethod@ScrollItemProxy@DirectUI@@UEAAJHPEAD@Z	1420	0x14003f3b4
?DoMethod@ScrollProxy@DirectUI@@UEAAJHPEAD@Z	1421	0x14001c3d0
?DoMethod@SelectionItemProxy@DirectUI@@UEAAJHPEAD@Z	1422	0x14002aa7c
?DoMethod@SelectionProxy@DirectUI@@UEAAJHPEAD@Z	1423	0x14002166c
?DoMethod@SelectorSelectionItemProxy@DirectUI@@UEAAJHPEAD@Z	1424	0x14002adc8
?DoMethod@SelectorSelectionProxy@DirectUI@@UEAAJHPEAD@Z	1425	0x140005174
?DoMethod@TableItemProxy@DirectUI@@UEAAJHPEAD@Z	1426	0x140009558
?DoMethod@TableProxy@DirectUI@@UEAAJHPEAD@Z	1427	0x140022f08
?DoMethod@ToggleProxy@DirectUI@@UEAAJHPEAD@Z	1428	0x1400019bc
?DoMethod@ValueProxy@DirectUI@@UEAAJHPEAD@Z	1429	0x140036fd4
?DockPattern@Schema@DirectUI@@2HA	1430	0x14000f7b4
?DocumentControlType@Schema@DirectUI@@2HA	1431	0x14003fd5c
?DoubleBuffered@Element@DirectUI@@QEAAX_N@Z	1432	0x14001937c
?Drag@Thumb@DirectUI@@SA?AVUID@@XZ	1433	0x140032e64
?DragDragCancelEvent@Schema@DirectUI@@2HA	1434	0x1400052a4
?DragDragCompleteEvent@Schema@DirectUI@@2HA	1435	0x14001c984
?DragDragStartEvent@Schema@DirectUI@@2HA	1436	0x14002bee8
?DragPattern@Schema@DirectUI@@2HA	1437	0x1400124dc
?Drag_DropEffect_Property@Schema@DirectUI@@2HA	1438	0x14003006c
?Drag_DropEffects_Property@Schema@DirectUI@@2HA	1439	0x1400098f4
?Drag_IsGrabbed_Property@Schema@DirectUI@@2HA	1440	0x1400334fc
?DrawOutlinesProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	1441	0x140015ea0
?DumpDuiProperties@@YAXPEAVElement@DirectUI@@@Z	1443	0x1400043b4
?DumpDuiTree@@YAXPEAVElement@DirectUI@@H@Z	1444	0x140022414
?EdgeHighlightColorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1445	0x140034c6c
?EdgeHighlightThicknessProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1446	0x140024424
?EditControlType@Schema@DirectUI@@2HA	1447	0x14000d708
?ElementFromPoint@HWNDElement@DirectUI@@QEAAPEAVElement@2@PEAUtagPOINT@@@Z	1448	0x140008cc0
?ElementFromPoint@HWNDElementProxy@DirectUI@@IEAAJNNPEAPEAUIRawElementProviderFragment@@@Z	1449	0x14002f6e8
?ElementMovesOnIHMNotifyProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	1450	0x140017994
?ElementProviderFromPoint@HWNDElementProvider@DirectUI@@UEAAJNNPEAPEAUIRawElementProviderFragment@@@Z	1451	0x140020bc8
?EnableDesignMode@DUIXmlParser@DirectUI@@QEAAXXZ	1452	0x1400309f4
?EnableUiaEvents@Element@DirectUI@@QEAAX_N@Z	1453	0x140020120
?EnabledProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1454	0x140026a24
?End@BaseScrollBar@DirectUI@@UEAAXXZ	1455	0x140023478
?EndDefer@Element@DirectUI@@QEAAXK@Z	1456	0x1400269ec
?EndDefer@EventManager@DirectUI@@SAJPEAVElement@2@@Z	1457	0x140022290
?EnforceSizeProp@PushButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	1458	0x140023674
?EnsureVisible@Element@DirectUI@@QEAA_NI@Z	1459	0x140018f0c
?EnsureVisible@Element@DirectUI@@QEAA_NXZ	1460	0x140027b44
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z	1461	0x14002a434
?EnsureVisible@Viewer@DirectUI@@UEAA_NHHHH@Z	1462	0x14002fda0
?Enter@Edit@DirectUI@@SA?AVUID@@XZ	1463	0x140008298
?Enter@TouchEditBase@DirectUI@@SA?AVUID@@XZ	1464	0x140033038
?Entered@Browser@DirectUI@@SA?AVUID@@XZ	1465	0x14000c538
?EnumCallstackFrames@CallstackTracker@DirectUI@@QEAAHP6AXPEBD0KK@Z@Z	1466	0x140031d3c
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z	1467	0x14001c9c0
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z	1468	0x140003c64
?EraseFeedback@TouchSlider@DirectUI@@QEAAXXZ	1469	0x14003ac04
?EstimateContentSize@CCPushButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1470	0x140032ef0
?EventFromEventId@Schema@DirectUI@@SA?AW4Event@12@H@Z	1471	0x140010c4c
?EventListener@EventManager@DirectUI@@SAJPEAVElement@2@PEAUEvent@2@@Z	1472	0x14002c418
?ExecuteManualSwapDeferredZoomToRect@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	1473	0x140037330
?Expand@ExpandCollapseProvider@DirectUI@@UEAAJXZ	1474	0x1400233bc
?ExpandCollapsePattern@Schema@DirectUI@@2HA	1475	0x1400121b8
?ExpandCollapse_ExpandCollapseState_Property@Schema@DirectUI@@2HA	1476	0x14000e6e4
?ExpandProp@Macro@DirectUI@@SAPEBUPropertyInfo@2@XZ	1477	0x140033198
?ExpandedProp@Expandable@DirectUI@@SAPEBUPropertyInfo@2@XZ	1478	0x14002c154
?ExtentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1479	0x140024e14
?FWantAnyEvent@EventManager@DirectUI@@SA_NPEAVElement@2@@Z	1480	0x14000c2b8
?FillSymbolInfo@CallstackTracker@DirectUI@@AEAAXPEAUSTACK_SYMBOL_INFO@12@_K@Z	1481	0x14003f4e0
?FilterOnPasteProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	1482	0x1400263cc
?FinalizeCurrentIMEComposition@TouchEdit2@DirectUI@@UEAAJXZ	1483	0x140035c64
?FinalizeCurrentIMEComposition@TouchEditBase@DirectUI@@UEAAJXZ	1484	0x140028b98
?Find@ElementProviderManager@DirectUI@@SAPEAVElementProvider@2@PEAVElement@2@@Z	1485	0x14003afc0
?FindAccessibleRole@AccessibleButton@DirectUI@@CAPEBUACCESSIBLEROLE@12@H@Z	1486	0x14000f648
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z	1487	0x14002fd84
?FindDescendentWorker@Element@DirectUI@@AEAAPEAV12@G@Z	1488	0x14000298c
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UEAAHGH@Z	1489	0x140022b5c
?FindInvokeHelper@InvokeManager@DirectUI@@CAPEAVInvokeHelper@2@PEAI@Z	1490	0x14000c060
?FindProviderCallback@ElementProviderManager@DirectUI@@CA_NPEAVElementProvider@2@PEAX@Z	1491	0x14000c1bc
?FindRefPoint@RefPointElement@DirectUI@@SAPEAVElement@2@PEAV32@PEAUtagPOINT@@@Z	1492	0x140014478
?FindShortcut@HWNDElement@DirectUI@@SA_NGPEAVElement@2@PEAPEAV32@PEAH2H@Z	1493	0x140014f58
?FindShortcutRecursive@HWNDElement@DirectUI@@KA_NGPEAVElement@2@PEAPEAV32@PEAH2H@Z	1494	0x140010c88
?FireAnimationChangeEvent@BaseScrollViewer@DirectUI@@IEAAX_N@Z	1495	0x14002c80c
?FireClickEvent@TouchButton@DirectUI@@UEAAXIIW4ClickDevice@12@PEAUtagPOINT@@@Z	1496	0x140041064
?FireClickEvent@TouchRepeatButton@DirectUI@@UEAAXIIW4ClickDevice@TouchButton@2@PEAUtagPOINT@@@Z	1497	0x14001d31c
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z	1498	0x140026e80
?FireEventOnMouseOrPointerRelease@TouchSlider@DirectUI@@QEAAXXZ	1499	0x140004160
?FireHostEvent@PushButton@DirectUI@@AEAAXPEAVElement@2@_N@Z	1500	0x14000c504
?FireNavigate@Browser@DirectUI@@AEAAHG@Z	1501	0x14002a3fc
?FireNavigationEvent@Navigator@DirectUI@@AEAAXXZ	1502	0x1400047a4
?FireRightClickEvent@TouchButton@DirectUI@@UEAAXIPEAUtagPOINT@@@Z	1503	0x14002014c
?FireRightClickEvent@TouchRepeatButton@DirectUI@@UEAAXIPEAUtagPOINT@@@Z	1504	0x14003bd6c
?FireStructureChangedEvent@EventManager@DirectUI@@SAJPEAVElement@2@W4StructureChangeType@@@Z	1505	0x140016a44
?FlagsProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	1506	0x14002982c
?FlushWorkingSet@HWNDElement@DirectUI@@QEAAXXZ	1507	0x140012f50
?FontColorRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1508	0x140010390
?FontFaceProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1509	0x14002eb50
?FontProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1510	0x14002a5a4
?FontQualityProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1511	0x14002c538
?FontSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1512	0x140019b80
?FontSizeRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1513	0x1400396d0
?FontStyleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1514	0x140027190
?FontWeightProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1515	0x140039eb4
?FontWeightRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	1516	0x140024d80
?ForceEditTextToLTRProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	1517	0x14001e6fc
?ForceThemeChange@XBaby@DirectUI@@UEAAX_K_J@Z	1518	0x140004514
?ForceThemeChange@XProvider@DirectUI@@UEAAJ_K_J@Z	1519	0x140009cec
?ForegroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	1520	0x140026828
?Forward@Movie@DirectUI@@QEAAXXZ	1521	0x14003f568
?ForwardingWindowMessage@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	1522	0x14002e1e4
?FrameDurationProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	1523	0x14000e780
?FrameIndexProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	1524	0x140030a18
?FrameWidthProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	1525	0x14003df94
?FrameworkId@Schema@DirectUI@@2HA	1526	0x1400136bc
?FreeComCtl32@TaskPage@DirectUI@@AEAAXXZ	1527	0x14002afb8
?FreeProvider@XElement@DirectUI@@QEAAXXZ	1528	0x140008164
?GetAbsorbsShortcut@Element@DirectUI@@QEAA_NXZ	1529	0x140004c20
?GetAccDefAction@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1530	0x1400043bc
?GetAccDesc@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1531	0x140037f98
?GetAccHelp@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1532	0x14000d404
?GetAccItemStatus@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1533	0x14002e400
?GetAccItemType@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1534	0x1400363f4
?GetAccName@DuiAccessible@DirectUI@@IEAAJUtagVARIANT@@HPEAPEAG@Z	1535	0x14001e234
?GetAccName@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1536	0x1400209c4
?GetAccNameAsDisplayed@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1537	0x140004d4c
?GetAccNameFromContent@DuiAccessible@DirectUI@@IEAAJPEAPEAG@Z	1538	0x14000b83c
?GetAccRole@Element@DirectUI@@QEAAHXZ	1539	0x140035328
?GetAccState@Element@DirectUI@@QEAAHXZ	1540	0x1400318e8
?GetAccValue@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1541	0x140030790
?GetAccessible@Element@DirectUI@@QEAA_NXZ	1542	0x14001a184
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1543	0x14001635c
?GetAccessibleImpl@HWNDElement@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1544	0x14001b220
?GetAccessibleImpl@HWNDHost@DirectUI@@AEAAJPEAPEAUIAccessible@@_N@Z	1545	0x14003eff8
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1546	0x14002cc6c
?GetAccessibleImpl@TouchEdit2@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z	1547	0x140009d28
?GetAccessibleParent@DuiAccessible@DirectUI@@SAPEAVElement@2@PEAV32@@Z	1548	0x14003d5ac
?GetActive@Element@DirectUI@@QEAAHXZ	1549	0x14003f858
?GetActiveState@TouchScrollBar@DirectUI@@QEAA?AW4ActiveState@2@XZ	1550	0x140011e20
?GetActualReferencePoint@RefPointElement@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z	1551	0x14000f224
?GetAdjacent@BorderLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1552	0x14002e8cc
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z	1553	0x140034ce4
?GetAdjacent@FillLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1554	0x140012924
?GetAdjacent@FlowLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1555	0x140003db8
?GetAdjacent@GridLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1556	0x140041234
?GetAdjacent@ItemList@DirectUI@@UEAAPEAVElement@2@PEAV32@HPEBUNavReference@2@K@Z	1557	0x1400111b0
?GetAdjacent@Layout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1558	0x140001134
?GetAdjacent@NineGridLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1559	0x14001ef44
?GetAdjacent@RowLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1560	0x140032754
?GetAdjacent@Selector@DirectUI@@UEAAPEAVElement@2@PEAV32@HPEBUNavReference@2@K@Z	1561	0x14003833c
?GetAdjacent@ShellBorderLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1562	0x1400011dc
?GetAdjacent@TableLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1563	0x1400021cc
?GetAdjacent@VerticalFlowLayout@DirectUI@@UEAAPEAVElement@2@PEAV32@0HPEBUNavReference@2@K@Z	1564	0x140003ddc
?GetAdjacent@XBaby@DirectUI@@UEAAPEAVElement@2@PEAV32@HPEBUNavReference@2@K@Z	1565	0x140032510
?GetAllowArrowOut@TouchScrollViewer@DirectUI@@QEAA_NXZ	1566	0x140001bb0
?GetAlpha@Element@DirectUI@@QEAAHXZ	1567	0x140019590
?GetAnimatePopupOnDismiss@TouchSelect@DirectUI@@QEAA_NXZ	1568	0x14003af50
?GetAnimation@Element@DirectUI@@QEAAHXZ	1569	0x14001d1fc
?GetAtom@Value@DirectUI@@QEAAGXZ	1570	0x140021f14
?GetAtomZero@Value@DirectUI@@SAPEAV12@XZ	1571	0x140009fcc
?GetAutoGrouping@CCRadioButton@DirectUI@@QEAA_NXZ	1572	0x140037744
?GetAutoStart@Movie@DirectUI@@QEAA_NXZ	1573	0x14000881c
?GetAutoStop@Movie@DirectUI@@QEAA_NXZ	1574	0x140029ab0
?GetAutomationId@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@@Z	1575	0x14003afa8
?GetBackgroundColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1576	0x1400382d8
?GetBackgroundOwner@HWNDHost@DirectUI@@IEAAPEAVElement@2@XZ	1577	0x140024be0
?GetBackgroundOwnerID@HWNDHost@DirectUI@@QEAAGXZ	1578	0x14003a6b0
?GetBackgroundStdColor@Element@DirectUI@@QEAAHXZ	1579	0x14000a428
?GetBool@EventManager@DirectUI@@CAJPEAUtagVARIANT@@PEAVValue@2@@Z	1580	0x140032ac8
?GetBool@Value@DirectUI@@QEAA_NXZ	1581	0x14003e23c
?GetBoolFalse@Value@DirectUI@@SAPEAV12@XZ	1582	0x140032f10
?GetBoolTrue@Value@DirectUI@@SAPEAV12@XZ	1583	0x1400347fc
?GetBorderColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1584	0x14002816c
?GetBorderStdColor@Element@DirectUI@@QEAAHXZ	1585	0x14000a16c
?GetBorderStyle@Element@DirectUI@@QEAAHXZ	1586	0x140018de0
?GetBorderThickness@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1587	0x140040348
?GetBoundingRect@ElementProxy@DirectUI@@IEAAJPEAUUiaRect@@@Z	1588	0x1400355a8
?GetBrowser@Navigator@DirectUI@@QEAAPEAVBrowser@2@XZ	1589	0x14002ea6c
?GetBuffering@TouchSlider@DirectUI@@QEAAHXZ	1590	0x1400197e8
?GetButtonClassAcceptsEnterKey@DialogElement@DirectUI@@UEAA_NXZ	1591	0x140021060
?GetButtonColor@CCPushButton@DirectUI@@UEAA_NPEAUHDC__@@PEAPEAUHBRUSH__@@@Z	1592	0x140033438
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z	1593	0x140040e7c
?GetCaptured@Button@DirectUI@@QEAA_NXZ	1594	0x140014eac
?GetCaptured@TouchButton@DirectUI@@QEAA_NXZ	1595	0x140020f60
?GetCellInfo@TableLayout@DirectUI@@QEAAPEAUCellInfo@2@H@Z	1596	0x1400353e8
?GetCheckedState@TouchCheckBox@DirectUI@@QEAA?AW4CheckedStateFlags@2@XZ	1597	0x1400034c4
?GetChildFromLayoutIndex@Layout@DirectUI@@QEAAPEAVElement@2@PEAV32@HPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@@Z	1598	0x14003bcfc
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ	1599	0x140011028
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z	1600	0x14000d384
?GetClass@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1601	0x140011310
?GetClassInfoPtr@AccessibleButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1602	0x14001093c
?GetClassInfoPtr@AnimationStrip@DirectUI@@SAPEAUIClassInfo@2@XZ	1603	0x1400160b4
?GetClassInfoPtr@AutoButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1604	0x140030608
?GetClassInfoPtr@BaseScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1605	0x14002e5d8
?GetClassInfoPtr@Bind@DirectUI@@SAPEAUIClassInfo@2@XZ	1606	0x14002133c
?GetClassInfoPtr@Browser@DirectUI@@SAPEAUIClassInfo@2@XZ	1607	0x14002bc84
?GetClassInfoPtr@Button@DirectUI@@SAPEAUIClassInfo@2@XZ	1608	0x14002ab90
?GetClassInfoPtr@CCAVI@DirectUI@@SAPEAUIClassInfo@2@XZ	1609	0x140040ee0
?GetClassInfoPtr@CCBase@DirectUI@@SAPEAUIClassInfo@2@XZ	1610	0x1400118e0
?GetClassInfoPtr@CCBaseCheckRadioButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1611	0x1400142cc
?GetClassInfoPtr@CCBaseScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1612	0x140038bd8
?GetClassInfoPtr@CCCheckBox@DirectUI@@SAPEAUIClassInfo@2@XZ	1613	0x140028f78
?GetClassInfoPtr@CCCommandLink@DirectUI@@SAPEAUIClassInfo@2@XZ	1614	0x140003154
?GetClassInfoPtr@CCHScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1615	0x14001c708
?GetClassInfoPtr@CCListBox@DirectUI@@SAPEAUIClassInfo@2@XZ	1616	0x14002e3bc
?GetClassInfoPtr@CCListView@DirectUI@@SAPEAUIClassInfo@2@XZ	1617	0x14002194c
?GetClassInfoPtr@CCProgressBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1618	0x1400038ec
?GetClassInfoPtr@CCPushButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1619	0x14001b030
?GetClassInfoPtr@CCRadioButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1620	0x14003523c
?GetClassInfoPtr@CCSysLink@DirectUI@@SAPEAUIClassInfo@2@XZ	1621	0x14002eac4
?GetClassInfoPtr@CCTrackBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1622	0x14002ea20
?GetClassInfoPtr@CCTreeView@DirectUI@@SAPEAUIClassInfo@2@XZ	1623	0x140022ac0
?GetClassInfoPtr@CCVScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1624	0x140015f90
?GetClassInfoPtr@CheckBoxGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1625	0x1400349b4
?GetClassInfoPtr@Clipper@DirectUI@@SAPEAUIClassInfo@2@XZ	1626	0x14000bddc
?GetClassInfoPtr@Combobox@DirectUI@@SAPEAUIClassInfo@2@XZ	1627	0x140031164
?GetClassInfoPtr@DialogElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1628	0x140015c14
?GetClassInfoPtr@Edit@DirectUI@@SAPEAUIClassInfo@2@XZ	1629	0x140002d5c
?GetClassInfoPtr@Element@DirectUI@@SAPEAUIClassInfo@2@XZ	1630	0x140014b38
?GetClassInfoPtr@ElementWithHWND@DirectUI@@SAPEAUIClassInfo@2@XZ	1631	0x14001f250
?GetClassInfoPtr@Expandable@DirectUI@@SAPEAUIClassInfo@2@XZ	1632	0x14001bb8c
?GetClassInfoPtr@Expando@DirectUI@@SAPEAUIClassInfo@2@XZ	1633	0x14001ad70
?GetClassInfoPtr@ExpandoButtonGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1634	0x140034420
?GetClassInfoPtr@HWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1635	0x14000b774
?GetClassInfoPtr@HWNDHost@DirectUI@@SAPEAUIClassInfo@2@XZ	1636	0x1400207f8
?GetClassInfoPtr@ItemList@DirectUI@@SAPEAUIClassInfo@2@XZ	1637	0x1400378dc
?GetClassInfoPtr@Macro@DirectUI@@SAPEAUIClassInfo@2@XZ	1638	0x14002804c
?GetClassInfoPtr@ModernProgressBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1639	0x1400316a0
?GetClassInfoPtr@ModernProgressRing@DirectUI@@SAPEAUIClassInfo@2@XZ	1640	0x140004c74
?GetClassInfoPtr@Movie@DirectUI@@SAPEAUIClassInfo@2@XZ	1641	0x14001bda4
?GetClassInfoPtr@Navigator@DirectUI@@SAPEAUIClassInfo@2@XZ	1642	0x14000b23c
?GetClassInfoPtr@PText@DirectUI@@SAPEAUIClassInfo@2@XZ	1643	0x1400218dc
?GetClassInfoPtr@Page@DirectUI@@SAPEAUIClassInfo@2@XZ	1644	0x140008d50
?GetClassInfoPtr@Pages@DirectUI@@SAPEAUIClassInfo@2@XZ	1645	0x140029484
?GetClassInfoPtr@Progress@DirectUI@@SAPEAUIClassInfo@2@XZ	1646	0x140034b04
?GetClassInfoPtr@PushButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1647	0x14000fb34
?GetClassInfoPtr@RadioButtonGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1648	0x14002b574
?GetClassInfoPtr@RefPointElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1649	0x14001f544
?GetClassInfoPtr@RepeatButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1650	0x14001bf3c
?GetClassInfoPtr@Repeater@DirectUI@@SAPEAUIClassInfo@2@XZ	1651	0x1400088d0
?GetClassInfoPtr@RichText@DirectUI@@SAPEAUIClassInfo@2@XZ	1652	0x14000a970
?GetClassInfoPtr@ScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1653	0x140024168
?GetClassInfoPtr@ScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1654	0x140037178
?GetClassInfoPtr@Selector@DirectUI@@SAPEAUIClassInfo@2@XZ	1655	0x140041198
?GetClassInfoPtr@SelectorNoDefault@DirectUI@@SAPEAUIClassInfo@2@XZ	1656	0x14001c714
?GetClassInfoPtr@SemanticZoomToggle@DirectUI@@SAPEAUIClassInfo@2@XZ	1657	0x14000e850
?GetClassInfoPtr@StyledScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1658	0x140027c44
?GetClassInfoPtr@TextGraphic@DirectUI@@SAPEAUIClassInfo@2@XZ	1659	0x14002e494
?GetClassInfoPtr@Thumb@DirectUI@@SAPEAUIClassInfo@2@XZ	1660	0x14000c5ac
?GetClassInfoPtr@TouchButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1661	0x140019644
?GetClassInfoPtr@TouchCheckBox@DirectUI@@SAPEAUIClassInfo@2@XZ	1662	0x14002a38c
?GetClassInfoPtr@TouchCheckBoxGlyph@DirectUI@@SAPEAUIClassInfo@2@XZ	1663	0x14001e3f4
?GetClassInfoPtr@TouchCommandButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1664	0x140031348
?GetClassInfoPtr@TouchEdit2@DirectUI@@SAPEAUIClassInfo@2@XZ	1665	0x14002b4dc
?GetClassInfoPtr@TouchEditBase@DirectUI@@SAPEAUIClassInfo@2@XZ	1666	0x140008d64
?GetClassInfoPtr@TouchHWNDElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1667	0x140029344
?GetClassInfoPtr@TouchHyperLink@DirectUI@@SAPEAUIClassInfo@2@XZ	1668	0x140040cb8
?GetClassInfoPtr@TouchRepeatButton@DirectUI@@SAPEAUIClassInfo@2@XZ	1669	0x14002083c
?GetClassInfoPtr@TouchScrollBar@DirectUI@@SAPEAUIClassInfo@2@XZ	1670	0x140038300
?GetClassInfoPtr@TouchScrollViewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1671	0x1400043dc
?GetClassInfoPtr@TouchSelect@DirectUI@@SAPEAUIClassInfo@2@XZ	1672	0x140031c24
?GetClassInfoPtr@TouchSelectItem@DirectUI@@SAPEAUIClassInfo@2@XZ	1673	0x1400303b8
?GetClassInfoPtr@TouchSlider@DirectUI@@SAPEAUIClassInfo@2@XZ	1674	0x14000d890
?GetClassInfoPtr@TouchSwitch@DirectUI@@SAPEAUIClassInfo@2@XZ	1675	0x14001bd48
?GetClassInfoPtr@UnknownElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1676	0x140015ba4
?GetClassInfoPtr@Viewer@DirectUI@@SAPEAUIClassInfo@2@XZ	1677	0x14002b358
?GetClassInfoPtr@XBaby@DirectUI@@SAPEAUIClassInfo@2@XZ	1678	0x14003160c
?GetClassInfoPtr@XElement@DirectUI@@SAPEAUIClassInfo@2@XZ	1679	0x1400118b0
?GetClassInfoW@AccessibleButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1680	0x1400235b8
?GetClassInfoW@AnimationStrip@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1681	0x140022bc8
?GetClassInfoW@AutoButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1682	0x14001c7a0
?GetClassInfoW@BaseScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1683	0x140021e40
?GetClassInfoW@Bind@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1684	0x140030ee8
?GetClassInfoW@Browser@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1685	0x14001b90c
?GetClassInfoW@Button@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1686	0x14001a068
?GetClassInfoW@CCAVI@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1687	0x140020638
?GetClassInfoW@CCBase@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1688	0x140004144
?GetClassInfoW@CCBaseCheckRadioButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1689	0x14003c050
?GetClassInfoW@CCBaseScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1690	0x140041768
?GetClassInfoW@CCCheckBox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1691	0x140014ee8
?GetClassInfoW@CCCommandLink@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1692	0x140001cb0
?GetClassInfoW@CCHScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1693	0x140001f34
?GetClassInfoW@CCListBox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1694	0x14001985c
?GetClassInfoW@CCListView@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1695	0x140033308
?GetClassInfoW@CCProgressBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1696	0x140036d80
?GetClassInfoW@CCPushButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1697	0x14003b6b4
?GetClassInfoW@CCRadioButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1698	0x1400310c0
?GetClassInfoW@CCSysLink@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1699	0x1400261c8
?GetClassInfoW@CCTrackBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1700	0x140004f64
?GetClassInfoW@CCTreeView@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1701	0x14000b664
?GetClassInfoW@CCVScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1702	0x14001db58
?GetClassInfoW@CheckBoxGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1703	0x14002ea28
?GetClassInfoW@Clipper@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1704	0x140033164
?GetClassInfoW@Combobox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1705	0x14003fb84
?GetClassInfoW@DialogElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1706	0x140016768
?GetClassInfoW@Edit@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1707	0x14001b4e4
?GetClassInfoW@Element@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1708	0x140013634
?GetClassInfoW@ElementWithHWND@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1709	0x14000b8d8
?GetClassInfoW@Expandable@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1710	0x14002a720
?GetClassInfoW@Expando@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1711	0x14001ec80
?GetClassInfoW@ExpandoButtonGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1712	0x140032bd4
?GetClassInfoW@HWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1713	0x14002c7d4
?GetClassInfoW@HWNDHost@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1714	0x140006954
?GetClassInfoW@ItemList@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1715	0x140008030
?GetClassInfoW@Macro@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1716	0x140003f30
?GetClassInfoW@ModernProgressBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1717	0x140028250
?GetClassInfoW@ModernProgressRing@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1718	0x1400289bc
?GetClassInfoW@Movie@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1719	0x140027370
?GetClassInfoW@Navigator@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1720	0x14003a688
?GetClassInfoW@PText@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1721	0x1400031d4
?GetClassInfoW@Page@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1722	0x14001d690
?GetClassInfoW@Pages@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1723	0x140039708
?GetClassInfoW@Progress@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1724	0x140024e4c
?GetClassInfoW@PushButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1725	0x140040090
?GetClassInfoW@RadioButtonGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1726	0x1400160ac
?GetClassInfoW@RefPointElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1727	0x14000d97c
?GetClassInfoW@RepeatButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1728	0x1400284ec
?GetClassInfoW@Repeater@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1729	0x140004804
?GetClassInfoW@RichText@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1730	0x14000edcc
?GetClassInfoW@ScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1731	0x140015fdc
?GetClassInfoW@ScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1732	0x140013784
?GetClassInfoW@Selector@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1733	0x140029570
?GetClassInfoW@SelectorNoDefault@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1734	0x14002dbf4
?GetClassInfoW@SemanticZoomToggle@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1735	0x14003555c
?GetClassInfoW@StyledScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1736	0x140032a20
?GetClassInfoW@TextGraphic@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1737	0x140034a30
?GetClassInfoW@Thumb@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1738	0x14000e810
?GetClassInfoW@TouchButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1739	0x140028704
?GetClassInfoW@TouchCheckBox@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1740	0x140011254
?GetClassInfoW@TouchCheckBoxGlyph@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1741	0x1400292e4
?GetClassInfoW@TouchCommandButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1742	0x140017abc
?GetClassInfoW@TouchEdit2@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1743	0x14003d8ac
?GetClassInfoW@TouchEditBase@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1744	0x14002ff98
?GetClassInfoW@TouchHWNDElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1745	0x140017814
?GetClassInfoW@TouchHyperLink@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1746	0x140023774
?GetClassInfoW@TouchRepeatButton@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1747	0x1400212b4
?GetClassInfoW@TouchScrollBar@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1748	0x140010db8
?GetClassInfoW@TouchScrollViewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1749	0x140002c64
?GetClassInfoW@TouchSelect@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1750	0x14000e958
?GetClassInfoW@TouchSelectItem@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1751	0x1400018f8
?GetClassInfoW@TouchSlider@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1752	0x14003c918
?GetClassInfoW@TouchSwitch@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1753	0x14000c664
?GetClassInfoW@UnknownElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1754	0x140040d74
?GetClassInfoW@Viewer@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1755	0x1400354a0
?GetClassInfoW@XBaby@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1756	0x14000a844
?GetClassInfoW@XElement@DirectUI@@UEAAPEAUIClassInfo@2@XZ	1757	0x1400309fc
?GetClickDevice@TouchButton@DirectUI@@QEAA?AW4ClickDevice@12@XZ	1758	0x14001ec14
?GetClickablePoint@Element@DirectUI@@QEAA_NPEAUtagPOINT@@@Z	1759	0x1400146c8
?GetClientAccessibleImpl@HWNDHost@DirectUI@@QEAAJPEAPEAUIAccessible@@@Z	1760	0x14002458c
?GetColorFromProperty@DirectUI@@YAJPEAVElement@1@PEBUPropertyInfo@1@HPEAK@Z	1761	0x14002ee1c
?GetColorFromValue@DirectUI@@YAJPEAVElement@1@PEAVValue@1@PEAK@Z	1762	0x14001e8e8
?GetColorTrans@Value@DirectUI@@SAPEAV12@XZ	1763	0x14002cfb4
?GetColorize@Element@DirectUI@@QEAAHXZ	1764	0x140040094
?GetColumn@GridItemProxy@DirectUI@@AEAAJPEAH@Z	1765	0x140010250
?GetColumnCount@GridProxy@DirectUI@@AEAAJPEAH@Z	1766	0x14002f820
?GetColumnHeaderItems@TableItemProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	1767	0x140009fcc
?GetColumnHeaders@TableProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	1768	0x1400237e4
?GetCommonDrawTextFlags@Element@DirectUI@@AEAAIH@Z	1769	0x140021e24
?GetCompositingQuality@Movie@DirectUI@@QEAAHXZ	1770	0x140008618
?GetConnect@Bind@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1771	0x140006d5c
?GetContainingGrid@GridItemProxy@DirectUI@@AEAAJPEAPEAUIRawElementProviderSimple@@@Z	1772	0x14002a090
?GetContent@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@PEAUIAccessible@@@Z	1773	0x140023b70
?GetContentAlign@Element@DirectUI@@QEAAHXZ	1774	0x14001d970
?GetContentCrossfadeOpacity@TouchScrollViewer@DirectUI@@QEAAMXZ	1775	0x140036bc8
?GetContentDesiredSize@XBaby@DirectUI@@UEAA?AUtagSIZE@@HH@Z	1776	0x14000eff4
?GetContentSize@CCBase@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1777	0x14002c4e4
?GetContentSize@CCBaseCheckRadioButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1778	0x14003fb48
?GetContentSize@CCCommandLink@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1779	0x1400206ac
?GetContentSize@CCHScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1780	0x14002259c
?GetContentSize@CCListBox@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1781	0x14002b800
?GetContentSize@CCListView@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1782	0x14002a8b4
?GetContentSize@CCPushButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1783	0x1400354ec
?GetContentSize@CCSysLink@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1784	0x14002f744
?GetContentSize@CCTreeView@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1785	0x1400291d4
?GetContentSize@CCVScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1786	0x140024408
?GetContentSize@Combobox@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1787	0x1400210fc
?GetContentSize@Edit@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1788	0x140039f18
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1789	0x140040d78
?GetContentSize@Progress@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1790	0x140027910
?GetContentSize@PushButton@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1791	0x140025ce8
?GetContentSize@RichText@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	1792	0x1400093d4
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1793	0x14002abac
?GetContentStringAsDisplayed@Edit@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1794	0x140022d9c
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1795	0x1400221b4
?GetContentStringAsDisplayed@TextGraphic@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1796	0x14001c284
?GetContentStringAsDisplayed@TouchEditBase@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z	1797	0x140007234
?GetControlType@ElementProxy@DirectUI@@IEAAXPEAUtagVARIANT@@PEAUIAccessible@@@Z	1798	0x1400046d8
?GetControllerFor@TouchEditBase@DirectUI@@UEAAJPEAPEAUIUnknown@@@Z	1799	0x14002f4a8
?GetCount@CCListBox@DirectUI@@QEAAHXZ	1800	0x14001bf5c
?GetCount@Pages@DirectUI@@QEAAIXZ	1801	0x14002ada8
?GetCreationFlags@XElement@DirectUI@@UEAAIXZ	1802	0x14003d320
?GetCurrentCols@GridLayout@DirectUI@@IEAAIH@Z	1803	0x14003bdd4
?GetCurrentCols@GridLayout@DirectUI@@IEAAIPEAVElement@2@@Z	1804	0x1400335a8
?GetCurrentPage@Browser@DirectUI@@QEAAPEAVElement@2@XZ	1805	0x140015d10
?GetCurrentPageID@Browser@DirectUI@@QEAAGXZ	1806	0x1400364f8
?GetCurrentRows@GridLayout@DirectUI@@IEAAIH@Z	1807	0x140022c74
?GetCurrentRows@GridLayout@DirectUI@@IEAAIPEAVElement@2@@Z	1808	0x140005780
?GetCursor@Value@DirectUI@@QEAAPEAUCursor@2@XZ	1809	0x1400092b0
?GetCursorNull@Value@DirectUI@@SAPEAV12@XZ	1810	0x140010430
?GetDPI@Element@DirectUI@@QEAAHXZ	1811	0x14001b984
?GetDataEntry@Macro@DirectUI@@QEAAPEAUIDataEntry@2@XZ	1812	0x14003f9e4
?GetDblListEmpty@Value@DirectUI@@SAPEAV12@XZ	1813	0x140024b3c
?GetDefaultButton@DialogElement@DirectUI@@UEAAPEAVElement@2@XZ	1814	0x14001890c
?GetDefaultButton@DialogElementCore@DirectUI@@QEAAPEAVElement@2@XZ	1815	0x140022484
?GetDefaultButtonTracking@DialogElement@DirectUI@@UEAA_NXZ	1816	0x140005cb8
?GetDefaultButtonTracking@XBaby@DirectUI@@UEAA_NXZ	1817	0x140015efc
?GetDeferObject@Element@DirectUI@@QEAAPEAVDeferCycle@2@XZ	1818	0x14000af08
?GetDesiredSize@Element@DirectUI@@QEAAPEBUtagSIZE@@XZ	1819	0x140020ce4
?GetDesiredSize@XProvider@DirectUI@@UEAAJHHPEAUtagSIZE@@@Z	1820	0x140016d7c
?GetDirection@Element@DirectUI@@QEAAHXZ	1821	0x140013718
?GetDirty@Edit@DirectUI@@QEAA_NXZ	1822	0x14002d91c
?GetDisableMouseInRectCheck@TouchRepeatButton@DirectUI@@QEAA_NXZ	1823	0x140010008
?GetDispatchFromElement@DuiAccessible@DirectUI@@IEAAJPEAVElement@2@PEAPEAUIDispatch@@@Z	1824	0x1400141c0
?GetDisplayNode@Element@DirectUI@@QEAAPEAUHGADGET__@@XZ	1825	0x140001274
?GetDoubleList@Value@DirectUI@@QEAAPEAV?$DynamicArray@N$0A@@2@XZ	1826	0x1400223b4
?GetDrawOutlines@Movie@DirectUI@@QEAA_NXZ	1827	0x140021324
?GetEdgeHighlightColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1828	0x140037774
?GetEdgeHighlightThickness@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1829	0x1400225c8
?GetElListNull@Value@DirectUI@@SAPEAV12@XZ	1830	0x140020084
?GetElement@CCBaseScrollBar@DirectUI@@UEAAPEAVElement@2@XZ	1831	0x14000676c
?GetElement@ElementProvider@DirectUI@@UEAAPEDVElement@2@XZ	1832	0x1400033fc
?GetElement@NativeHWNDHost@DirectUI@@QEAAPEAVElement@2@XZ	1833	0x140008f60
?GetElement@ScrollBar@DirectUI@@UEAAPEAVElement@2@XZ	1834	0x140018520
?GetElement@TaskPage@DirectUI@@IEAAPEAVElement@2@XZ	1835	0x1400313e4
?GetElement@Value@DirectUI@@QEAAPEAVElement@2@XZ	1836	0x140031228
?GetElement@XHost@DirectUI@@QEAAPEAVElement@2@XZ	1837	0x140007b8c
?GetElementKey@ElementProvider@DirectUI@@QEAAPEBVElement@2@XZ	1838	0x140007c00
?GetElementList@Value@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@XZ	1839	0x14002cd34
?GetElementMovesOnIHMNotify@TouchEditBase@DirectUI@@QEAA_NXZ	1840	0x14000e408
?GetElementNull@Value@DirectUI@@SAPEAV12@XZ	1841	0x1400269e0
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z	1842	0x14002718c
?GetElementProviderImpl@TouchSelect@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z	1843	0x14003e564
?GetElementProviderImpl@XBaby@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z	1844	0x14000cdbc
?GetElementScaleFactor@Element@DirectUI@@QEAAMXZ	1845	0x14002c894
?GetElementScaledFloat@Value@DirectUI@@QEAAMPEAVElement@2@@Z	1846	0x1400137ec
?GetElementScaledInt@Value@DirectUI@@QEAAHPEAVElement@2@@Z	1847	0x1400285b8
?GetElementScaledPoint@Value@DirectUI@@QEAAXPEAVElement@2@PEAUtagPOINT@@@Z	1848	0x14003f060
?GetElementScaledRect@Value@DirectUI@@QEAAXPEAVElement@2@PEAUtagRECT@@@Z	1849	0x14003f220
?GetElementScaledSize@Value@DirectUI@@QEAAXPEAVElement@2@PEAUtagSIZE@@@Z	1850	0x14000dd44
?GetEmbeddedFragmentRoots@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	1851	0x14002dde8
?GetEnabled@Element@DirectUI@@QEAA_NXZ	1852	0x140008e9c
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z	1853	0x140003280
?GetEncodedContentStringLength@Element@DirectUI@@QEAA_KXZ	1854	0x140017bc8
?GetEncodedString@Value@DirectUI@@QEAAJPEAG_K@Z	1855	0x14000e26c
?GetEncodedStringLength@Value@DirectUI@@QEAA_KXZ	1856	0x14002722c
?GetEnforceSize@PushButton@DirectUI@@QEAA_NXZ	1857	0x140019c80
?GetExpand@Macro@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1858	0x14003f408
?GetExpandCollapseState@EventManager@DirectUI@@CAXPEAUtagVARIANT@@@Z	1859	0x1400136f8
?GetExpanded@Expandable@DirectUI@@QEAA_NXZ	1860	0x1400252f4
?GetExprNull@Value@DirectUI@@SAPEAV12@XZ	1861	0x140004648
?GetExpression@Value@DirectUI@@QEAAPEAVExpression@2@XZ	1862	0x14001806c
?GetExtent@Element@DirectUI@@QEAAPEBUtagSIZE@@PEAPEAVValue@2@@Z	1863	0x14001720c
?GetFactory@RichText@DirectUI@@QEAAPEAUIDWriteFactory@@XZ	1864	0x14003bbd8
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ	1865	0x14002b760
?GetFill@Value@DirectUI@@QEAAPEBUFill@2@XZ	1866	0x140036e00
?GetFillpartElement@TouchSlider@DirectUI@@QEAAPEAVElement@2@XZ	1867	0x140006624
?GetFilterOnPaste@TouchEditBase@DirectUI@@QEAA_NXZ	1868	0x14003ca2c
?GetFlags@TouchHWNDElement@DirectUI@@QEAA?AW4TouchHWNDElementFlags@2@XZ	1869	0x140012e40
?GetFloat@Value@DirectUI@@QEAAMXZ	1870	0x14000574c
?GetFloatOne@Value@DirectUI@@SAPEAV12@XZ	1871	0x14003ec68
?GetFloatZero@Value@DirectUI@@SAPEAV12@XZ	1872	0x140038994
?GetFocus@HWNDElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderFragment@@@Z	1873	0x140029c20
?GetFocus@HWNDElementProxy@DirectUI@@IEAAJPEAPEAUIRawElementProviderFragment@@@Z	1874	0x140037424
?GetFocusableElement@XBaby@DirectUI@@UEAAPEAVElement@2@XZ	1875	0x14000a924
?GetFocusedHWNDElement@HWNDElement@DirectUI@@SAPEAV12@XZ	1876	0x140002f5c
?GetFont@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1877	0x14001e894
?GetFont@HWNDHost@DirectUI@@IEAAPEAUHFONT__@@XZ	1878	0x14002deac
?GetFontFace@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	1879	0x140037248
?GetFontQuality@Element@DirectUI@@QEAAHXZ	1880	0x14001f7a0
?GetFontSize@Element@DirectUI@@QEAAHXZ	1881	0x140001f84
?GetFontStyle@Element@DirectUI@@QEAAHXZ	1882	0x140017b60
?GetFontWeight@Element@DirectUI@@QEAAHXZ	1883	0x1400257f4
?GetForceEditTextToLTR@TouchEditBase@DirectUI@@QEAA_NXZ	1884	0x1400066dc
?GetForegroundColor@Element@DirectUI@@QEAAPEBUFill@2@PEAPEAVValue@2@@Z	1885	0x1400017d8
?GetForegroundColorRef@RichText@DirectUI@@UEAAJPEAK@Z	1886	0x140006a3c
?GetForegroundColorRef@TouchButton@DirectUI@@UEAAJPEAK@Z	1887	0x1400386b0
?GetForegroundStdColor@Element@DirectUI@@QEAAHXZ	1888	0x14000af74
?GetFragmentRoot@ElementProxy@DirectUI@@IEAAJPEAPEAUIRawElementProviderFragmentRoot@@@Z	1889	0x140012278
?GetFrameDuration@AnimationStrip@DirectUI@@QEAAHXZ	1890	0x1400279c8
?GetFrameIndex@AnimationStrip@DirectUI@@QEAAHXZ	1891	0x14001d600
?GetFrameWidth@AnimationStrip@DirectUI@@QEAAHXZ	1892	0x14002ed5c
?GetGetSheetCallback@DUIXmlParser@DirectUI@@QEAAP6APEAVValue@2@PEBGPEAX@ZXZ	1893	0x14002d308
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ	1894	0x140013418
?GetGraphic@Value@DirectUI@@QEAAPEAUGraphic@2@XZ	1895	0x14003c004
?GetHDC@DCSurface@DirectUI@@QEAAPEAUHDC__@@XZ	1896	0x14002fe34
?GetHInstance@DUIXmlParser@DirectUI@@QEAAPEAUHINSTANCE__@@XZ	1897	0x140035cbc
?GetHScroll@ScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	1898	0x14002fe14
?GetHScroll@StyledScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	1899	0x140031f4c
?GetHScrollbar@TouchScrollViewer@DirectUI@@QEAAJPEAPEAVElement@2@@Z	1900	0x14002cb30
?GetHWND@HWNDElement@DirectUI@@UEAAPEAUHWND__@@XZ	1901	0x1400185a4
?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ	1902	0x140040408
?GetHWND@NativeHWNDHost@DirectUI@@QEAAPEAUHWND__@@XZ	1903	0x1400061ac
?GetHWND@XHost@DirectUI@@QEAAPEAUHWND__@@XZ	1904	0x140021950
?GetHWNDParent@HWNDHost@DirectUI@@QEAAPEAUHWND__@@XZ	1905	0x1400128bc
?GetHandle@ResourceModuleHandles@DirectUI@@QEAAJPEBGPEAPEAUHINSTANCE__@@@Z	1906	0x1400261ac
?GetHandleEnter@TouchButton@DirectUI@@QEAA_NXZ	1907	0x14003a028
?GetHandleEnterKey@DialogElement@DirectUI@@UEAA_NXZ	1908	0x1400399b0
?GetHandleGlobalEnter@TouchButton@DirectUI@@QEAA_NXZ	1909	0x14000b5bc
?GetHasShield@CCPushButton@DirectUI@@QEAA_NXZ	1910	0x140011678
?GetHeight@Element@DirectUI@@QEAAHXZ	1911	0x140012210
?GetHighDPI@Element@DirectUI@@QEAA_NXZ	1912	0x14000c558
?GetHostedElementID@XBaby@DirectUI@@UEAAJPEAG@Z	1913	0x14001a120
?GetHostedElementID@XProvider@DirectUI@@UEAAJPEAG@Z	1914	0x1400128fc
?GetHwnd@ElementProxy@DirectUI@@IEAAJPEAPEAUHWND__@@@Z	1915	0x140001b0c
?GetID@Element@DirectUI@@QEAAGXZ	1916	0x14000a168
?GetIDsOfNames@DuiAccessible@DirectUI@@UEAAJAEBU_GUID@@PEAPEAGIKPEAJ@Z	1917	0x140008944
?GetIHMRect@TouchHWNDElement@DirectUI@@QEAAJPEAUtagRECT@@@Z	1918	0x1400120c8
?GetIHMState@TouchHWNDElement@DirectUI@@QEAA?AW4IHMState@2@XZ	1919	0x140035ef8
?GetIMEComposing@TouchEditBase@DirectUI@@QEAA_NXZ	1920	0x1400146a0
?GetIdentityString@DuiAccessible@DirectUI@@UEAAJKPEAPEAEPEAK@Z	1921	0x140028d60
?GetIdentityString@HWNDHostAccessible@DirectUI@@UEAAJKPEAPEAEPEAK@Z	1922	0x1400043dc
?GetIgnoredKeyCombos@TouchEditBase@DirectUI@@QEAA?AW4TouchEditFilteredKeyComboFlags@2@XZ	1923	0x140040fc8
?GetImage@Value@DirectUI@@QEAAPEAX_NM@Z	1924	0x140012c18
?GetImmediateChild@Element@DirectUI@@QEAAPEAV12@PEAV12@@Z	1925	0x140007cac
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UEAAXPEAUtagRECT@@@Z	1926	0x14000e46c
?GetImmersiveFocusRectOffsets@TouchButton@DirectUI@@UEAAXPEAUtagRECT@@@Z	1927	0x1400149c0
?GetImmersiveFocusRectOffsets@TouchCheckBox@DirectUI@@UEAAXPEAUtagRECT@@@Z	1928	0x14002e56c
?GetImmersiveFocusRectOffsets@TouchHyperLink@DirectUI@@UEAAXPEAUtagRECT@@@Z	1929	0x14002dc18
?GetIndex@Element@DirectUI@@QEAAHXZ	1930	0x1400041fc
?GetInertiaEndpointVisibleRect@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@@Z	1931	0x14003eb64
?GetInertiaEndpointZoomLevel@TouchScrollViewer@DirectUI@@QEAAMM@Z	1932	0x14000bf00
?GetInnerBorderThickness@TouchEdit2@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1933	0x14003c27c
?GetInnerHWND@XElement@DirectUI@@QEAAPEAUHWND__@@XZ	1934	0x140037f08
?GetInputScope@TouchEdit2@DirectUI@@QEAA?AW4__MIDL___MIDL_itf_inputscope_0000_0000_0001@@XZ	1935	0x14002ba14
?GetInt@EventManager@DirectUI@@CAJPEAUtagVARIANT@@PEAVValue@2@@Z	1936	0x140034ed0
?GetInt@Value@DirectUI@@QEAAHXZ	1937	0x14002d13c
?GetIntMinusOne@Value@DirectUI@@SAPEAV12@XZ	1938	0x14001934c
?GetIntZero@Value@DirectUI@@SAPEAV12@XZ	1939	0x140010b18
?GetIntegrateIMECandidateList@TouchEditBase@DirectUI@@QEAA_NXZ	1940	0x140029570
?GetInteractionMode@TouchScrollViewer@DirectUI@@QEAAHXZ	1941	0x14001c1f0
?GetInterpolationMode@Movie@DirectUI@@QEAAHXZ	1942	0x14003cebc
?GetInvokeHelper@InvokeManager@DirectUI@@SAJPEAPEAVInvokeHelper@2@@Z	1943	0x140009a3c
?GetIsContinuous@TouchSlider@DirectUI@@QEAA_NXZ	1944	0x140028984
?GetIsPressed@TouchSlider@DirectUI@@QEAA_NXZ	1945	0x1400363a0
?GetIsReadOnly@ValueProxy@DirectUI@@AEAAJPEAH@Z	1946	0x140031dd8
?GetIsSelected@NavigatorSelectionItemProxy@DirectUI@@AEAAJPEAVBrowser@2@PEAH@Z	1947	0x140003ed0
?GetIsSelectionRequired@BrowserSelectionProxy@DirectUI@@AEAAJPEAH@Z	1948	0x140027d40
?GetIsSelectionRequired@SelectorSelectionProxy@DirectUI@@AEAAJPEAH@Z	1949	0x140011184
?GetIsShowOnOffFeedback@TouchSlider@DirectUI@@QEAA_NXZ	1950	0x140022890
?GetIsVertical@TouchSlider@DirectUI@@QEAA_NXZ	1951	0x140040354
?GetItem@GridProvider@DirectUI@@UEAAJHHPEAPEAUIRawElementProviderSimple@@@Z	1952	0x14000a4b0
?GetItem@GridProxy@DirectUI@@AEAAJIIPEAPEAUIRawElementProviderSimple@@@Z	1953	0x140012000
?GetItemCount@TouchSelect@DirectUI@@QEAAKXZ	1954	0x14001bb3c
?GetItemData@TouchSelect@DirectUI@@QEAAJHPEAPEAUIUnknown@@@Z	1955	0x14000bbd8
?GetItemData@TouchSelectItem@DirectUI@@QEAAJPEAPEAUIUnknown@@@Z	1956	0x140014f74
?GetItemHeightInPopup@TouchSelect@DirectUI@@QEAAHXZ	1957	0x14000b5c4
?GetItemState@CCTreeView@DirectUI@@QEAAIQEAU_TREEITEM@@@Z	1958	0x14003b7d4
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ	1959	0x1400030c8
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ	1960	0x1400282fc
?GetKeyFocusedElement@DialogElement@DirectUI@@UEAAPEAVElement@2@XZ	1961	0x14003ab58
?GetKeyFocusedElement@HWNDElement@DirectUI@@SAPEAVElement@2@XZ	1962	0x140041520
?GetKeyWithin@Element@DirectUI@@QEAA_NXZ	1963	0x140034b40
?GetKeyWithinChild@Element@DirectUI@@QEAAPEAV12@XZ	1964	0x14000c218
?GetKeyboardNavigationCapture@TouchEditBase@DirectUI@@QEAA?AW4TouchEditKeyboardNavigationCapture@2@XZ	1965	0x140032dc4
?GetLabel@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@@Z	1966	0x14000d8b8
?GetLayout@Element@DirectUI@@QEAAPEAVLayout@2@PEAPEAVValue@2@@Z	1967	0x14002c2b4
?GetLayout@Value@DirectUI@@QEAAPEAVLayout@2@XZ	1968	0x140021104
?GetLayoutChildCount@Layout@DirectUI@@QEAAIPEAVElement@2@@Z	1969	0x14000f5c4
?GetLayoutIndexFromChild@Layout@DirectUI@@QEAAHPEAVElement@2@0@Z	1970	0x14003e5f0
?GetLayoutNull@Value@DirectUI@@SAPEAV12@XZ	1971	0x1400371ec
?GetLayoutPos@Element@DirectUI@@QEAAHXZ	1972	0x1400341ac
?GetLightDismissIHM@TouchHWNDElement@DirectUI@@QEAA_NXZ	1973	0x14003f908
?GetLine@CCBaseScrollBar@DirectUI@@UEAAHXZ	1974	0x14002b620
?GetLine@FlowLayout@DirectUI@@QEAAHPEAVElement@2@0@Z	1975	0x14000db40
?GetLine@ScrollBar@DirectUI@@UEAAHXZ	1976	0x140021fe4
?GetLine@VerticalFlowLayout@DirectUI@@QEAAHPEAVElement@2@0@Z	1977	0x140004a68
?GetLineCount@RichText@DirectUI@@QEAAKXZ	1978	0x140020a5c
?GetLineSize@CCTrackBar@DirectUI@@QEAAHXZ	1979	0x14002b9d4
?GetLinkIndicatorsToContent@TouchScrollViewer@DirectUI@@QEAA_NXZ	1980	0x1400321c8
?GetLocation@Element@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z	1981	0x140002da4
?GetManipulationCompositor@TouchScrollViewer@DirectUI@@QEAAPEAUIDirectManipulationCompositor@@XZ	1982	0x140024e74
?GetManipulationHorizontalAlignment@TouchScrollViewer@DirectUI@@QEAAHXZ	1983	0x140027550
?GetManipulationManager@TouchScrollViewer@DirectUI@@QEAAPEAUIDirectManipulationManager@@XZ	1984	0x140002430
?GetManipulationVerticalAlignment@TouchScrollViewer@DirectUI@@QEAAHXZ	1985	0x14002753c
?GetManipulationViewport@TouchScrollViewer@DirectUI@@QEAAPEAUIDirectManipulationViewport@@_N@Z	1986	0x140031a74
?GetMargin@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	1987	0x140027840
?GetMaxLength@Edit@DirectUI@@QEAAHXZ	1988	0x140029e58
?GetMaxLength@TouchEditBase@DirectUI@@QEAAHXZ	1989	0x1400058c8
?GetMaximum@CCBaseScrollBar@DirectUI@@UEAAHXZ	1990	0x14001ea9c
?GetMaximum@ModernProgressBar@DirectUI@@QEAAHXZ	1991	0x1400267e4
?GetMaximum@Progress@DirectUI@@QEAAHXZ	1992	0x14002f864
?GetMaximum@ScrollBar@DirectUI@@UEAAHXZ	1993	0x14002990c
?GetMetering@TouchSlider@DirectUI@@QEAAHXZ	1994	0x14003f2ec
?GetMinSize@Element@DirectUI@@QEAAPEBUtagSIZE@@PEAPEAVValue@2@@Z	1995	0x140031510
?GetMinimum@CCBaseScrollBar@DirectUI@@UEAAHXZ	1996	0x1400272d4
?GetMinimum@ModernProgressBar@DirectUI@@QEAAHXZ	1997	0x1400182ec
?GetMinimum@Progress@DirectUI@@QEAAHXZ	1998	0x1400242c4
?GetMinimum@ScrollBar@DirectUI@@UEAAHXZ	1999	0x14003948c
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ	2000	0x1400285d8
?GetModuleBase@CallstackTracker@DirectUI@@AEAA_KPEAX_K@Z	2001	0x14003170c
?GetMouseFocused@Element@DirectUI@@QEAA_NXZ	2002	0x140036334
?GetMouseWithin@Element@DirectUI@@QEAA_NXZ	2003	0x14003c1e4
?GetMouseWithinChild@Element@DirectUI@@QEAAPEAV12@XZ	2004	0x140006978
?GetMouseWithinHorizontalScrollRegion@TouchScrollViewer@DirectUI@@QEAA_NXZ	2005	0x140020704
?GetMoveCaretToEndOnSyncContent@TouchEditBase@DirectUI@@QEAA_NXZ	2006	0x14002bd0c
?GetMultiline@Edit@DirectUI@@QEAA_NXZ	2007	0x140002d7c
?GetMultiline@TouchEditBase@DirectUI@@QEAA_NXZ	2008	0x140013dac
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ	2009	0x14003f6d0
?GetNote@CCCommandLink@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2010	0x140016928
?GetNotificationSinkHWND@XElement@DirectUI@@UEAAPEAUHWND__@@XZ	2011	0x1400341c4
?GetNull@Value@DirectUI@@SAPEAV12@XZ	2012	0x140019fa4
?GetOffText@TouchSwitch@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2013	0x140030acc
?GetOnText@TouchSwitch@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2014	0x140037db4
?GetOptimizeMove@HWNDHost@DirectUI@@QEAA_NXZ	2015	0x140006544
?GetOrder@ScrollBar@DirectUI@@QEAAHXZ	2016	0x14000478c
?GetOverhang@Element@DirectUI@@QEAA_NXZ	2017	0x14000c0a0
?GetOverrideButtonBackground@CCPushButton@DirectUI@@QEAA_NXZ	2018	0x14001535c
?GetOverrideScaleFactor@DUIXmlParser@DirectUI@@QEBA_NPEAM@Z	2019	0x14003e848
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ	2020	0x140029ac8
?GetPVLAnimationState@Element@DirectUI@@QEAAHXZ	2021	0x14002ae40
?GetPadding@Element@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	2022	0x14001b664
?GetPage@CCBaseScrollBar@DirectUI@@UEAAHXZ	2023	0x140004568
?GetPage@Pages@DirectUI@@QEAAPEAVElement@2@I@Z	2024	0x140014958
?GetPage@Pages@DirectUI@@QEAAPEAVElement@2@PEBG@Z	2025	0x140003a68
?GetPage@ScrollBar@DirectUI@@UEAAHXZ	2026	0x140021b38
?GetPageInc@BaseScrollBar@DirectUI@@QEAAHXZ	2027	0x140011194
?GetPageRCID@TaskPage@DirectUI@@MEAAIXZ	2028	0x1400167f8
?GetPageResID@TaskPage@DirectUI@@MEAAPEBGXZ	2029	0x140037098
?GetPages@Browser@DirectUI@@QEAAPEAVPages@2@XZ	2030	0x140024594
?GetParent@Element@DirectUI@@QEAAPEAV12@XZ	2031	0x1400023f8
?GetParentHWND@TaskPage@DirectUI@@QEAAPEAUHWND__@@XZ	2032	0x14002b610
?GetParser@DUIFactory@DirectUI@@QEAAPEAVDUIXmlParser@2@XZ	2033	0x14001be70
?GetParserCommon@DUIXmlParser@DirectUI@@IEAAJPEAPEAV12@@Z	2034	0x140024bd0
?GetPasswordCharacter@Edit@DirectUI@@QEAAHXZ	2035	0x14002ae74
?GetPasswordCharacter@TouchEditBase@DirectUI@@QEAAHXZ	2036	0x140017304
?GetPasswordRevealMode@TouchEdit2@DirectUI@@QEAA?AW4TouchEditPasswordRevealMode@2@XZ	2037	0x140016738
?GetPath@Movie@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2038	0x140037874
?GetPatternProvider@ElementProvider@DirectUI@@UEAAJHPEAPEAUIUnknown@@@Z	2039	0x140029c88
?GetPinning@BaseScrollViewer@DirectUI@@QEAAHXZ	2040	0x14003af9c
?GetPixelOffsetMode@Movie@DirectUI@@QEAAHXZ	2041	0x14001fc78
?GetPlay@AnimationStrip@DirectUI@@QEAA_NXZ	2042	0x140006304
?GetPlayAllFramesMode@Movie@DirectUI@@QEAA_NXZ	2043	0x14002b570
?GetPoint@Value@DirectUI@@QEAAPEBUtagPOINT@@XZ	2044	0x14002d020
?GetPointZero@Value@DirectUI@@SAPEAV12@XZ	2045	0x140040260
?GetPopupBounds@TouchSelect@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	2046	0x140036a24
?GetPosition@CCBaseScrollBar@DirectUI@@UEAAHXZ	2047	0x140024cb4
?GetPosition@ModernProgressBar@DirectUI@@QEAAHXZ	2048	0x1400323e8
?GetPosition@Progress@DirectUI@@QEAAHXZ	2049	0x14001cff8
?GetPosition@ScrollBar@DirectUI@@UEAAHXZ	2050	0x140008d3c
?GetPredictedVisibleRect@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@@Z	2051	0x14002666c
?GetPreserveAlphaChannel@Element@DirectUI@@QEBA_NXZ	2052	0x140040344
?GetPressed@Button@DirectUI@@QEAA_NXZ	2053	0x14000c4ec
?GetPressed@TouchButton@DirectUI@@QEAA_NXZ	2054	0x140008b0c
?GetPreventFormatChangeUpdatingModifiedState@TouchEditBase@DirectUI@@QEAA_NXZ	2055	0x1400179a4
?GetProcs@Schema@DirectUI@@CAJXZ	2056	0x1400314e4
?GetPromptText@TouchEdit2@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2057	0x14003b230
?GetPromptWithCaret@TouchEdit2@DirectUI@@QEAA_NXZ	2058	0x14003abbc
?GetPropValPairInfo@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUIClassInfo@2@PEBG2PEAPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	2059	0x140013aa4
?GetPropValPairInfo@DUIXmlParser@DirectUI@@IEAAJULINEINFO@2@PEAUIClassInfo@2@PEBG2PEAPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	2060	0x14002f680
?GetProperty@Bind@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2061	0x140017668
?GetProperty@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@H@Z	2062	0x1400325a8
?GetPropertyValue@ElementProvider@DirectUI@@UEAAJHPEAUtagVARIANT@@@Z	2063	0x14003c6c0
?GetProportional@CCBaseScrollBar@DirectUI@@UEAA_NXZ	2064	0x140004e44
?GetProportional@ScrollBar@DirectUI@@UEAA_NXZ	2065	0x140034a24
?GetProvider@XElement@DirectUI@@QEAAPEAUIXProvider@2@XZ	2066	0x14001c584
?GetProviderOptions@ElementProxy@DirectUI@@IEAAJPEAW4ProviderOptions@@@Z	2067	0x140013950
?GetProxyCreator@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2068	0x14003bb98
?GetProxyCreator@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2069	0x1400388d8
?GetProxyCreator@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2070	0x1400073bc
?GetProxyCreator@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2071	0x140028514
?GetProxyCreator@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2072	0x140032bc8
?GetProxyCreator@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2073	0x140024544
?GetProxyCreator@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2074	0x14000ad3c
?GetProxyCreator@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2075	0x140021ad0
?GetProxyCreator@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2076	0x1400313f0
?GetProxyCreator@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2077	0x14003d48c
?GetProxyCreator@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2078	0x14001f0a0
?GetProxyCreator@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2079	0x140023b64
?GetProxyCreator@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2080	0x1400338f4
?GetProxyCreator@ElementProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2081	0x14001a8e4
?GetProxyCreator@ExpandCollapseProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2082	0x1400385ac
?GetProxyCreator@GridItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2083	0x140040b48
?GetProxyCreator@GridProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2084	0x140027f9c
?GetProxyCreator@HWNDElementProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2085	0x14002d860
?GetProxyCreator@InvokeProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2086	0x140014014
?GetProxyCreator@RangeValueProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2087	0x14003e07c
?GetProxyCreator@ScrollItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2088	0x14001e1b8
?GetProxyCreator@ScrollProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2089	0x140017008
?GetProxyCreator@SelectionItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2090	0x140038d98
?GetProxyCreator@SelectionProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2091	0x140002f0c
?GetProxyCreator@TableItemProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2092	0x140027d4c
?GetProxyCreator@TableProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2093	0x14000c1fc
?GetProxyCreator@ToggleProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2094	0x14000da10
?GetProxyCreator@ValueProvider@DirectUI@@UEAAP6APEAVProviderProxy@2@PEAVElement@2@@ZXZ	2095	0x14003304c
?GetRangeMax@CCTrackBar@DirectUI@@QEAAHXZ	2096	0x14000dc44
?GetRangeMax@TouchSlider@DirectUI@@QEAAHXZ	2097	0x140033394
?GetRangeMin@CCTrackBar@DirectUI@@QEAAHXZ	2098	0x14003e618
?GetRangeMin@TouchSlider@DirectUI@@QEAAHXZ	2099	0x14000c3fc
?GetRawValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z	2100	0x14001a1ec
?GetReadOnly@TouchEditBase@DirectUI@@QEAA_NXZ	2101	0x140036804
?GetRect@Value@DirectUI@@QEAAPEBUtagRECT@@XZ	2102	0x14001b7f0
?GetRectZero@Value@DirectUI@@SAPEAV12@XZ	2103	0x140039328
?GetRefCount@Value@DirectUI@@QEBAHXZ	2104	0x14003eeb4
?GetReferencePoint@RefPointElement@DirectUI@@QEAAPEBUtagPOINT@@PEAPEAVValue@2@@Z	2105	0x14002177c
?GetRegisteredDefaultButton@DialogElement@DirectUI@@UEAAPEAVElement@2@XZ	2106	0x14001cda0
?GetRenderBorderThickness@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2107	0x140039010
?GetRenderEdgeHighlightThickness@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2108	0x14002d4b0
?GetRenderMargin@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2109	0x14000a43c
?GetRenderMinSize@Element@DirectUI@@QEAAXPEAUtagSIZE@@@Z	2110	0x14003f23c
?GetRenderPadding@Element@DirectUI@@QEAAXPEAUtagRECT@@@Z	2111	0x140013014
?GetRepeat@Movie@DirectUI@@QEAA_NXZ	2112	0x140023084
?GetResourceHInstance@DUIXmlParser@DirectUI@@QEAAPEAUHINSTANCE__@@XZ	2113	0x1400195f8
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ	2114	0x140027d40
?GetRoot@XProvider@DirectUI@@IEAAPEAVElement@2@XZ	2115	0x140027998
?GetRootRelativeBounds@Element@DirectUI@@QEAAJPEAUtagRECT@@@Z	2116	0x1400165c0
?GetRow@GridItemProxy@DirectUI@@AEAAJPEAH@Z	2117	0x14001ad00
?GetRowCount@GridProxy@DirectUI@@AEAAJPEAH@Z	2118	0x140023af0
?GetRowHeaderItems@TableItemProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2119	0x1400089f0
?GetRowHeaders@TableProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2120	0x14003b298
?GetRuntimeId@ElementProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2121	0x1400047ec
?GetRuntimeId@ElementProxy@DirectUI@@IEAAJPEAPEAUtagSAFEARRAY@@@Z	2122	0x14001fdb0
?GetScaledFloat@Value@DirectUI@@QEAAMM@Z	2123	0x140017118
?GetScaledInt@Value@DirectUI@@QEAAHM@Z	2124	0x140016e14
?GetScaledInt@Value@DirectUI@@QEAAPEBUScaledInt@2@XZ	2125	0x140036e98
?GetScaledPoint@Value@DirectUI@@QEAAXMPEAUtagPOINT@@@Z	2126	0x140017ac4
?GetScaledRect@Value@DirectUI@@QEAAXMPEAUtagRECT@@@Z	2127	0x140041210
?GetScaledSize@Value@DirectUI@@QEAAXMPEAUtagSIZE@@@Z	2128	0x14001d378
?GetScrollBar@ScrollProxy@DirectUI@@AEAAPEAVBaseScrollBar@2@_N@Z	2129	0x14002fb7c
?GetScrollBarHelper@ScrollProxy@DirectUI@@AEAAPEAVBaseScrollBar@2@PEAVElement@2@_N@Z	2130	0x14002dc90
?GetScrollPadding@TouchScrollViewer@DirectUI@@QEAAPEBUtagRECT@@PEAPEAVValue@2@@Z	2131	0x14003a464
?GetScrollPercent@ScrollProxy@DirectUI@@AEAAJ_NPEAN@Z	2132	0x14001b130
?GetScrollable@ScrollProxy@DirectUI@@AEAAJ_NPEAH@Z	2133	0x140014f24
?GetSelected@Element@DirectUI@@QEAA_NXZ	2134	0x140024f18
?GetSelection@BrowserSelectionProxy@DirectUI@@AEAAJPEAPEAUtagSAFEARRAY@@@Z	2135	0x14001d210
?GetSelection@Combobox@DirectUI@@QEAAHXZ	2136	0x14003c06c
?GetSelection@SelectionProvider@DirectUI@@UEAAJPEAPEAUtagSAFEARRAY@@@Z	2137	0x14003024c
?GetSelection@Selector@DirectUI@@QEAAPEAVElement@2@XZ	2138	0x14000ab60
?GetSelection@TouchEdit2@DirectUI@@QEAAJPEAJ0@Z	2139	0x1400016cc
?GetSelection@TouchSelect@DirectUI@@QEAAPEAVElement@2@XZ	2140	0x14001d6b0
?GetSelectionBackgroundColor@TouchEditBase@DirectUI@@QEAAPEAVValue@2@XZ	2141	0x14003e354
?GetSelectionContainer@SelectorSelectionItemProxy@DirectUI@@AEAAJPEAPEAUIRawElementProviderSimple@@@Z	2142	0x140032968
?GetSelectionForegroundColor@TouchEditBase@DirectUI@@QEAAPEAVValue@2@XZ	2143	0x14001f718
?GetSelectionIndex@TouchSelect@DirectUI@@QEAAHXZ	2144	0x14001acd4
?GetShadowIntensity@Element@DirectUI@@QEAAHXZ	2145	0x14002f05c
?GetSheet@DUIXmlParser@DirectUI@@QEAAJPEBGPEAPEAVValue@2@@Z	2146	0x140018780
?GetSheet@Element@DirectUI@@QEAAPEAVStyleSheet@2@XZ	2147	0x1400055bc
?GetSheetContext@DUIXmlParser@DirectUI@@QEAAPEAXXZ	2148	0x140040e2c
?GetSheetNull@Value@DirectUI@@SAPEAV12@XZ	2149	0x140006d80
?GetShortcut@Element@DirectUI@@QEAAHXZ	2150	0x14002cb80
?GetShortcutChar@Element@DirectUI@@QEAAGXZ	2151	0x14002a3c0
?GetShortcutChar@RichText@DirectUI@@QEAAGXZ	2152	0x14002aba0
?GetShowClearButtonMinWidth@TouchEdit2@DirectUI@@QEAAHXZ	2153	0x14000a610
?GetShowKeyFocus@TouchButton@DirectUI@@QEAA_NXZ	2154	0x1400062bc
?GetShowTick@TouchSlider@DirectUI@@QEAA_NXZ	2155	0x140003788
?GetSinkRect@HWNDHost@DirectUI@@AEAAXPEBUtagRECT@@PEAU3@@Z	2156	0x1400126c0
?GetSize@Value@DirectUI@@QEAAPEBUtagSIZE@@XZ	2157	0x140015334
?GetSizeZero@Value@DirectUI@@SAPEAV12@XZ	2158	0x14002ff68
?GetSmoothingMode@Movie@DirectUI@@QEAAHXZ	2159	0x140017f1c
?GetSnapIntervalX@TouchScrollViewer@DirectUI@@QEAAMXZ	2160	0x140014168
?GetSnapIntervalY@TouchScrollViewer@DirectUI@@QEAAMXZ	2161	0x140022f28
?GetSnapMode@TouchScrollViewer@DirectUI@@QEAAHXZ	2162	0x140034ee4
?GetSnapOffsetX@TouchScrollViewer@DirectUI@@QEAAMXZ	2163	0x14002df70
?GetSnapOffsetY@TouchScrollViewer@DirectUI@@QEAAMXZ	2164	0x14003d778
?GetSnapPointCollectionX@TouchScrollViewer@DirectUI@@QEAAPEAV?$DynamicArray@N$0A@@2@PEAPEAVValue@2@@Z	2165	0x14002cab4
?GetSnapPointCollectionY@TouchScrollViewer@DirectUI@@QEAAPEAV?$DynamicArray@N$0A@@2@PEAPEAVValue@2@@Z	2166	0x14003ff40
?GetState@ModernProgressBar@DirectUI@@QEAAHXZ	2167	0x140029fdc
?GetStaticColor@HWNDHost@DirectUI@@IEAA_NPEAUHDC__@@PEAPEAUHBRUSH__@@@Z	2168	0x14001ff04
?GetStepCount@TouchSlider@DirectUI@@QEAAHXZ	2169	0x14003e020
?GetString@EventManager@DirectUI@@CAJPEAUtagVARIANT@@PEAVValue@2@@Z	2170	0x14002a2d8
?GetString@Value@DirectUI@@QEAAPEBGXZ	2171	0x140014b4c
?GetStringDynamicScaling@Value@DirectUI@@QEAAPEBGXZ	2172	0x14000feb4
?GetStringNull@Value@DirectUI@@SAPEAV12@XZ	2173	0x14001e954
?GetStringRPNull@Value@DirectUI@@SAPEAV12@XZ	2174	0x140006abc
?GetStyle@CCTreeView@DirectUI@@QEAAKXZ	2175	0x14000fa0c
?GetStyleSheet@Value@DirectUI@@QEAAPEAVStyleSheet@2@XZ	2176	0x14001a228
?GetSubContent@TouchCommandButton@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2177	0x14003c004
?GetSuppressClearButton@TouchEdit2@DirectUI@@QEAA_NXZ	2178	0x14001f794
?GetSurfaceType@Surface@DirectUI@@SA?AW4EType@12@I@Z	2179	0x14003ca2c
?GetSurfaceType@Surface@DirectUI@@SAIW4EType@12@@Z	2180	0x140006b88
?GetSyncContentWhileIMEComposing@TouchEditBase@DirectUI@@QEAA_NXZ	2181	0x1400016e4
?GetTargetPage@Navigator@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2182	0x14000287c
?GetTextContentOverride@TouchSelectItem@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2183	0x1400026ac
?GetTextDocument@TouchEdit2@DirectUI@@UEAAJPEAPEAUITextDocument@@@Z	2184	0x140007fd0
?GetTextDocument@TouchEditBase@DirectUI@@UEAAJPEAPEAUITextDocument@@@Z	2185	0x14002a80c
?GetTextGlowSize@Element@DirectUI@@QEAAHXZ	2186	0x140014fc4
?GetTextHeight@Edit@DirectUI@@AEAAIXZ	2187	0x140009f08
?GetTextHost@TouchEdit2@DirectUI@@QEAAJPEAPEAVITextHost@@@Z	2188	0x140015608
?GetTextMode@TouchEditBase@DirectUI@@QEAA?AW4TouchEditTextMode@2@XZ	2189	0x140019168
?GetTextSelection@TouchEdit2@DirectUI@@QEAAJPEAPEAUITextSelection@@@Z	2190	0x140021e6c
?GetTextServices@TouchEdit2@DirectUI@@UEAAJPEAPEAVITextServices@@@Z	2191	0x14003f43c
?GetTextServices@TouchEditBase@DirectUI@@UEAAJPEAPEAVITextServices@@@Z	2192	0x140023ea4
?GetTheme@Element@DirectUI@@AEAAJPEBGPEAPEAX@Z	2193	0x1400348d0
?GetThemeChanged@HWNDHost@DirectUI@@IEAAHXZ	2194	0x14002a400
?GetThemedBorder@Edit@DirectUI@@QEAA_NXZ	2195	0x140002898
?GetThumb@TouchScrollBar@DirectUI@@QEAAPEAVElement@2@XZ	2196	0x140035eac
?GetThumbElement@TouchSlider@DirectUI@@QEAAPEAVButton@2@XZ	2197	0x14000ee50
?GetThumbPosition@CCTrackBar@DirectUI@@QEAAHXZ	2198	0x1400411e4
?GetThumbValue@TouchSlider@DirectUI@@QEAAHXZ	2199	0x140003270
?GetTickCount@TouchSlider@DirectUI@@QEAAHXZ	2200	0x140010994
?GetTitleText@TouchSwitch@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z	2201	0x1400138f4
?GetToggleOnClick@TouchCheckBox@DirectUI@@QEAA_NXZ	2202	0x14000f9fc
?GetToggleState@EventManager@DirectUI@@CAXPEAUtagVARIANT@@@Z	2203	0x140026ce4
?GetToggleState@ToggleProxy@DirectUI@@AEAAJPEAW4ToggleState@@@Z	2204	0x14001aaf8
?GetToggleValue@TouchSwitch@DirectUI@@QEAAHXZ	2205	0x14003a4fc
?GetTooltip@Element@DirectUI@@QEAA_NXZ	2206	0x14000a2cc
?GetTooltipMaxWidth@Element@DirectUI@@QEAAHXZ	2207	0x140022074
?GetTooltipMaximumLineCount@TouchHWNDElement@DirectUI@@QEAAHXZ	2208	0x14000b230
?GetTopLevel@Element@DirectUI@@QEAAPEAV12@XZ	2209	0x14002d858
?GetTrackElement@TouchSlider@DirectUI@@QEAAPEAVElement@2@XZ	2210	0x140037024
?GetTracking@CCBaseScrollBar@DirectUI@@QEAA_NXZ	2211	0x14003d840
?GetTranslatedTileRects@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@PEAII@Z	2212	0x140035e0c
?GetTransparent@HWNDHost@DirectUI@@QEAA_NXZ	2213	0x14003a4ac
?GetTreatRightMouseButtonAsLeft@TouchButton@DirectUI@@QEAA_NXZ	2214	0x14003d3dc
?GetTreeAlphaLevel@Element@DirectUI@@QEAAMXZ	2215	0x14002f2c0
?GetTrimmedLineCount@RichText@DirectUI@@QEAAKXZ	2216	0x14003a6f8
?GetType@DCSurface@DirectUI@@UEBA?AW4EType@Surface@2@XZ	2217	0x14000b478
?GetType@Value@DirectUI@@QEBAHXZ	2218	0x14000f110
?GetTypeInfo@DuiAccessible@DirectUI@@UEAAJIKPEAPEAUITypeInfo@@@Z	2219	0x14003fc54
?GetTypeInfoCount@DuiAccessible@DirectUI@@UEAAJPEAI@Z	2220	0x14001c664
?GetUIAElementProvider@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	2221	0x1400063f0
?GetUIState@HWNDElement@DirectUI@@QEAAGXZ	2222	0x14001dc88
?GetUiaFocusDelegate@Element@DirectUI@@UEAAPEAV12@XZ	2223	0x1400220e4
?GetUiaFocusDelegate@TouchEdit2@DirectUI@@UEAAPEAVElement@2@XZ	2224	0x1400310c4
?GetUnavailable@Value@DirectUI@@SAPEAV12@XZ	2225	0x1400018bc
?GetUnset@Value@DirectUI@@SAPEAV12@XZ	2226	0x14003f414
?GetVScroll@ScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	2227	0x140002828
?GetVScroll@StyledScrollViewer@DirectUI@@MEAAPEAVBaseScrollBar@2@XZ	2228	0x14002db38
?GetVScrollbar@TouchScrollViewer@DirectUI@@QEAAJPEAPEAVElement@2@@Z	2229	0x14003cd3c
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@P6APEBUPropertyInfo@2@XZHPEAUUpdateCache@2@@Z	2230	0x140037898
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z	2231	0x140009634
?GetValue@ValueProxy@DirectUI@@AEAAJPEAPEAG@Z	2232	0x140010c14
?GetValueList@Value@DirectUI@@QEAAPEAV?$DynamicArray@PEAVValue@DirectUI@@$0A@@2@XZ	2233	0x140019948
?GetValueParser@DUIXmlParser@DirectUI@@IEAAJPEAPEAVValueParser@ParserTools@2@@Z	2234	0x14002ed14
?GetVertical@ScrollBar@DirectUI@@QEAA_NXZ	2235	0x1400174e8
?GetViewSize@ScrollProxy@DirectUI@@AEAAJ_NPEAN@Z	2236	0x14002a04c
?GetViewer@ScrollProxy@DirectUI@@AEAAJPEAPEAVViewer@2@@Z	2237	0x14000bce8
?GetVisible@Element@DirectUI@@QEAA_NXZ	2238	0x14003f55c
?GetVisibleRect@TouchScrollViewer@DirectUI@@QEAAXPEAUtagRECT@@@Z	2239	0x140011004
?GetVisited@TouchHyperLink@DirectUI@@QEAA_NXZ	2240	0x14002c174
?GetVisualState@TouchSlider@DirectUI@@QEAAHXZ	2241	0x14001d6a0
?GetWantTabs@Edit@DirectUI@@QEAA_NXZ	2242	0x140004a38
?GetWidth@Element@DirectUI@@QEAAHXZ	2243	0x14001b460
?GetWinStyle@CCBase@DirectUI@@QEAAHXZ	2244	0x140028f7c
?GetWindow@DuiAccessible@DirectUI@@UEAAJPEAPEAUHWND__@@@Z	2245	0x14003b69c
?GetWindow@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAUHWND__@@@Z	2246	0x14003ec00
?GetWindowAccessGradientColor@TouchHWNDElement@DirectUI@@QEAAPEAVValue@2@XZ	2247	0x140020630
?GetWindowActive@Element@DirectUI@@QEAA_NXZ	2248	0x1400306cc
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UEAAXPEAPEBGPEAI@Z	2249	0x1400412d8
?GetWrapKeyboardNavigate@HWNDElement@DirectUI@@QEAA_NXZ	2250	0x140031800
?GetX@Element@DirectUI@@QEAAHXZ	2251	0x14001fa4c
?GetXBabyElement@XBaby@DirectUI@@UEAAPEAVHWNDElement@2@XZ	2252	0x14001d618
?GetXBarVisibility@BaseScrollViewer@DirectUI@@QEAAHXZ	2253	0x14003bd30
?GetXOffset@BaseScrollViewer@DirectUI@@QEAAHXZ	2254	0x140036088
?GetXOffset@Viewer@DirectUI@@QEAAHXZ	2255	0x1400190f0
?GetXScrollHeight@BaseScrollViewer@DirectUI@@QEAAHXZ	2256	0x140033e00
?GetXScrollable@BaseScrollViewer@DirectUI@@QEAA_NXZ	2257	0x1400193cc
?GetXScrollable@Viewer@DirectUI@@QEAA_NXZ	2258	0x14000186c
?GetXmlLiteDll@DUIXmlParser@DirectUI@@KAJPEAPEAUHINSTANCE__@@@Z	2259	0x140025c08
?GetY@Element@DirectUI@@QEAAHXZ	2260	0x1400364a8
?GetYBarVisibility@BaseScrollViewer@DirectUI@@QEAAHXZ	2261	0x14002f374
?GetYOffset@BaseScrollViewer@DirectUI@@QEAAHXZ	2262	0x14002af04
?GetYOffset@Viewer@DirectUI@@QEAAHXZ	2263	0x1400398c8
?GetYScrollWidth@BaseScrollViewer@DirectUI@@QEAAHXZ	2264	0x14003dc10
?GetYScrollable@BaseScrollViewer@DirectUI@@QEAA_NXZ	2265	0x14000d7a0
?GetYScrollable@Viewer@DirectUI@@QEAA_NXZ	2266	0x14003f3b8
?GetZoomMaximum@TouchScrollViewer@DirectUI@@QEAAMXZ	2267	0x140004e88
?GetZoomMinimum@TouchScrollViewer@DirectUI@@QEAAMXZ	2268	0x1400396b0
?GridItemPattern@Schema@DirectUI@@2HA	2269	0x1400053a4
?GridItem_ColumnSpan_Property@Schema@DirectUI@@2HA	2270	0x140028d24
?GridItem_Column_Property@Schema@DirectUI@@2HA	2271	0x14001c038
?GridItem_Parent_Property@Schema@DirectUI@@2HA	2272	0x14002eb00
?GridItem_RowSpan_Property@Schema@DirectUI@@2HA	2273	0x140029704
?GridItem_Row_Property@Schema@DirectUI@@2HA	2274	0x14002698c
?GridPattern@Schema@DirectUI@@2HA	2275	0x140011418
?Grid_ColumnCount_Property@Schema@DirectUI@@2HA	2276	0x140017078
?Grid_RowCount_Property@Schema@DirectUI@@2HA	2277	0x140010360
?GroupControlType@Schema@DirectUI@@2HA	2278	0x140021d78
?HandleAccChange@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2279	0x14001c27c
?HandleAccDesc@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2280	0x140021b8c
?HandleAccPatternChange@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@IIHPEAUtagVARIANT@@2P6AX2@Z@Z	2281	0x140004c88
?HandleAccRoleEvent@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@PEAVValue@2@1@Z	2282	0x1400286dc
?HandleAccStateChange@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@IIHPEAUtagVARIANT@@1_N@Z	2283	0x1400159f4
?HandleBoolProp@EventManager@DirectUI@@CAJPEAVElement@2@P6A_N0@ZPEAUIRawElementProviderSimple@@HPEAVValue@2@3@Z	2284	0x14001819c
?HandleChildrenEvent@EventManager@DirectUI@@CAJPEAVElement@2@PEAVValue@2@1@Z	2285	0x140029870
?HandleEnterKeyProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	2286	0x140028e74
?HandleEnterProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2287	0x140024ff4
?HandleGlobalEnterProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2288	0x1400306d0
?HandleRangeValue@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2289	0x140005a00
?HandleScrollPos@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2290	0x14001fdb4
?HandleSelectedChange@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@PEAVValue@2@@Z	2291	0x14001631c
?HandleStringProp@EventManager@DirectUI@@CAJPEAUIRawElementProviderSimple@@HPEAVValue@2@1@Z	2292	0x14000cb7c
?HandleToggleValue@EventManager@DirectUI@@CAJPEAVElement@2@PEAUIRawElementProviderSimple@@PEAVValue@2@2@Z	2293	0x140005cb0
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ	2294	0x140023bfc
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z	2295	0x14001a168
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z	2296	0x14000ac58
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2297	0x1400402cc
?HandleVisibilityChange@EventManager@DirectUI@@CAJPEAVElement@2@I@Z	2298	0x14001c43c
?HasAnimation@Element@DirectUI@@QEAA_NXZ	2299	0x140013ec0
?HasBorder@Element@DirectUI@@QEAA_NXZ	2300	0x140022044
?HasChildren@Element@DirectUI@@QEAA_NXZ	2301	0x14001d784
?HasContent@Element@DirectUI@@QEAA_NXZ	2302	0x14003e724
?HasEdgeHighlight@Element@DirectUI@@QEAA_NXZ	2303	0x14001bd60
?HasKeyboardFocusProperty@Schema@DirectUI@@2HA	2304	0x14003605c
?HasLayout@Element@DirectUI@@QEAA_NXZ	2305	0x140015764
?HasMargin@Element@DirectUI@@QEAA_NXZ	2306	0x140020d50
?HasPVLAnimationState@Element@DirectUI@@QEAA_NI@Z	2307	0x14000d4b4
?HasPadding@Element@DirectUI@@QEAA_NXZ	2308	0x140014f1c
?HasSelection@TouchEdit2@DirectUI@@QEAA_NXZ	2309	0x14003b620
?HasShieldProp@CCPushButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2310	0x140036b48
?HaveWin32Focus@HWNDHost@DirectUI@@AEAA_NXZ	2311	0x14001e090
?HeaderControlType@Schema@DirectUI@@2HA	2312	0x14002a76c
?HeaderItemControlType@Schema@DirectUI@@2HA	2313	0x14000f81c
?HeightProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2314	0x140032ab8
?HelpTextProperty@Schema@DirectUI@@2HA	2315	0x140024bd0
?HideTouchTooltip@TouchHWNDElement@DirectUI@@QEAAJXZ	2316	0x14002318c
?HideWindow@NativeHWNDHost@DirectUI@@QEAAXXZ	2317	0x14003d2a0
?HideWindow@XHost@DirectUI@@QEAAXXZ	2318	0x14003c02c
?HighDPIProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2319	0x14002daa0
?Home@BaseScrollBar@DirectUI@@UEAAXXZ	2320	0x1400194c0
?Host@NativeHWNDHost@DirectUI@@QEAAXPEAVElement@2@@Z	2321	0x14001203c
?Host@XHost@DirectUI@@QEAAXPEAVElement@2@@Z	2322	0x14003d2f0
?Hosted@PushButton@DirectUI@@SA?AVUID@@XZ	2323	0x140033d84
?HyperlinkControlType@Schema@DirectUI@@2HA	2324	0x14003a5b8
?IDProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2325	0x14003d8b8
?IHMNotify@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	2326	0x14003b94c
?IMEComposingProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2327	0x140014bf8
?INITIALSTACKSKIP@CallstackTracker@DirectUI@@0HB	2328	0x140026d80
?IgnoredKeyCombosProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2329	0x140036010
?ImageControlType@Schema@DirectUI@@2HA	2330	0x140037684
?ImmersiveColorSchemeChange@HWNDElement@DirectUI@@SA?AVUID@@XZ	2331	0x1400323e4
?Init@?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2332	0x14000b3d8
?Init@?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2333	0x1400343d4
?Init@?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2334	0x14001ffdc
?Init@?$PatternProvider@VInvokeProvider@DirectUI@@UIInvokeProvider@@$0A@@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2335	0x1400114e8
?Init@?$PatternProvider@VRangeValueProvider@DirectUI@@UIRangeValueProvider@@$03@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2336	0x14003e090
?Init@?$PatternProvider@VScrollItemProvider@DirectUI@@UIScrollItemProvider@@$05@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2337	0x14003cc04
?Init@?$PatternProvider@VScrollProvider@DirectUI@@UIScrollProvider@@$04@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2338	0x14002dd84
?Init@?$PatternProvider@VSelectionItemProvider@DirectUI@@UISelectionItemProvider@@$06@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2339	0x140028fb0
?Init@?$PatternProvider@VSelectionProvider@DirectUI@@UISelectionProvider@@$07@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2340	0x140016ec8
?Init@?$PatternProvider@VTableItemProvider@DirectUI@@UITableItemProvider@@$09@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2341	0x140008ae4
?Init@?$PatternProvider@VTableProvider@DirectUI@@UITableProvider@@$08@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2342	0x14000fdbc
?Init@?$PatternProvider@VToggleProvider@DirectUI@@UIToggleProvider@@$0L@@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2343	0x14001d268
?Init@?$PatternProvider@VValueProvider@DirectUI@@UIValueProvider@@$0M@@DirectUI@@UEAAXPEAVElementProvider@2@@Z	2344	0x140028e78
?Init@AutoThread@DirectUI@@QEAAJXZ	2345	0x140027c08
?Init@BrowserSelectionProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2346	0x14000e780
?Init@CallstackTracker@DirectUI@@SAHXZ	2347	0x140022600
?Init@ElementProvider@DirectUI@@MEAAJPEAVElement@2@PEAVInvokeHelper@2@@Z	2348	0x14002b7a4
?Init@ElementProviderManager@DirectUI@@SAJXZ	2349	0x1400213ec
?Init@ElementProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2350	0x14002e554
?Init@EventManager@DirectUI@@SAJXZ	2351	0x14000b198
?Init@ExpandCollapseProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2352	0x140037f4c
?Init@GridItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2353	0x14000f784
?Init@GridProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2354	0x14003cd68
?Init@HWNDElementProvider@DirectUI@@MEAAJPEAVHWNDElement@2@PEAVInvokeHelper@2@@Z	2355	0x1400154c0
?Init@HWNDElementProxy@DirectUI@@UEAAXPEAVHWNDElement@2@@Z	2356	0x1400019c0
?Init@InvokeHelper@DirectUI@@QEAAHK@Z	2357	0x14000e350
?Init@InvokeManager@DirectUI@@SAJXZ	2358	0x14001b3ac
?Init@InvokeProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2359	0x140012a20
?Init@ModernProgressBarRangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2360	0x1400232e0
?Init@NavReference@DirectUI@@QEAAXPEAVElement@2@PEAUtagRECT@@@Z	2361	0x14001ac4c
?Init@NavScoring@DirectUI@@QEAAXPEAVElement@2@HPEBUNavReference@2@@Z	2362	0x140018624
?Init@NavigatorSelectionItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2363	0x1400311e4
?Init@ProgressRangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2364	0x140032a50
?Init@ProviderProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2365	0x140010f68
?Init@RangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2366	0x140031838
?Init@Schema@DirectUI@@SAJXZ	2367	0x14003a0e8
?Init@ScrollBarRangeValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2368	0x14002f1b4
?Init@ScrollItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2369	0x14003213c
?Init@ScrollProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2370	0x14001b130
?Init@SelectionItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2371	0x14000c568
?Init@SelectionProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2372	0x14000fca8
?Init@SelectorSelectionItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2373	0x140006694
?Init@SelectorSelectionProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2374	0x140027280
?Init@TableItemProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2375	0x14002b6b0
?Init@TableProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2376	0x140007478
?Init@ToggleProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2377	0x14002a658
?Init@ValueProxy@DirectUI@@MEAAXPEAVElement@2@@Z	2378	0x14002193c
?InitOnceCallback@CallstackTracker@DirectUI@@CAHPEAT_RTL_RUN_ONCE@@PEAXPEAPEAX@Z	2379	0x140041054
?InitProcess@FontCache@DirectUI@@SAJXZ	2380	0x1400232a0
?InitPropSheetPage@TaskPage@DirectUI@@MEAAXPEAU_PROPSHEETPAGEW@@@Z	2381	0x14002c068
?InitThread@FontCache@DirectUI@@SAJXZ	2382	0x140013c88
?Initialize@AccessibleButton@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2383	0x140019d00
?Initialize@AnimationStrip@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2384	0x14000f108
?Initialize@AutoButton@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2385	0x140033558
?Initialize@BaseScrollViewer@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2386	0x14001d728
?Initialize@Bind@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2387	0x14000e3e0
?Initialize@BorderLayout@DirectUI@@QEAAXXZ	2388	0x140039cfc
?Initialize@Browser@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2389	0x140040578
?Initialize@Button@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2390	0x140001478
?Initialize@CCBase@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2391	0x14000bc04
?Initialize@CCBaseScrollBar@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2392	0x14003c250
?Initialize@CCListView@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2393	0x14000155c
?Initialize@CCProgressBar@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2394	0x140038f78
?Initialize@CSafeElementProxy@@IEAAJPEAVElement@DirectUI@@@Z	2395	0x140038690
?Initialize@CheckBoxGlyph@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2396	0x14000b2ec
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z	2397	0x140027d4c
?Initialize@Clipper@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2398	0x140025f94
?Initialize@Combobox@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2399	0x140005348
?Initialize@DUIXmlParser@DirectUI@@IEAAJXZ	2400	0x140019c54
?Initialize@DialogElementCore@DirectUI@@QEAAXPEAUIDialogElement@2@PEAUIElementListener@2@@Z	2401	0x1400383d8
?Initialize@DuiAccessible@DirectUI@@QEAAXPEAVElement@2@@Z	2402	0x140005304
?Initialize@Edit@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2403	0x140022bfc
?Initialize@Element@DirectUI@@QEAAJIPEAV12@PEAK@Z	2404	0x14001765c
?Initialize@Expando@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2405	0x140001414
?Initialize@ExpandoButtonGlyph@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2406	0x140016338
?Initialize@FillLayout@DirectUI@@QEAAXXZ	2407	0x14002aef8
?Initialize@FlowLayout@DirectUI@@QEAAX_NIII@Z	2408	0x140001cd8
?Initialize@GridLayout@DirectUI@@QEAAXHH@Z	2409	0x1400071cc
?Initialize@HWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z	2410	0x14002af64
?Initialize@HWNDElementAccessible@DirectUI@@QEAAJPEAVHWNDElement@2@@Z	2411	0x14000ffd4
?Initialize@HWNDHost@DirectUI@@QEAAJIIPEAVElement@2@PEAK@Z	2412	0x140003ff4
?Initialize@HWNDHostAccessible@DirectUI@@QEAAJPEAVElement@2@PEAUIAccessible@@@Z	2413	0x14000f210
?Initialize@Layout@DirectUI@@QEAAXXZ	2414	0x140006148
?Initialize@Macro@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2415	0x14003fa6c
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@I@Z	2416	0x140025d18
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBGPEAUHWND__@@PEAUHICON__@@HHHHHHI@Z	2417	0x140032144
?Initialize@Navigator@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2418	0x1400338ec
?Initialize@NineGridLayout@DirectUI@@QEAAXXZ	2419	0x14003e3bc
?Initialize@PText@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2420	0x14003cdfc
?Initialize@Page@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2421	0x140025428
?Initialize@Pages@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2422	0x140021fc8
?Initialize@Progress@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2423	0x140001b34
?Initialize@RadioButtonGlyph@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2424	0x140022860
?Initialize@RefPointElement@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2425	0x140026384
?Initialize@RepeatButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2426	0x14001f0f8
?Initialize@Repeater@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2427	0x14003b328
?Initialize@RichText@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2428	0x1400073e4
?Initialize@RowLayout@DirectUI@@QEAAJHII@Z	2429	0x1400087c4
?Initialize@ScrollBar@DirectUI@@QEAAJ_NPEAVElement@2@PEAK@Z	2430	0x14000d170
?Initialize@Selector@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2431	0x1400244dc
?Initialize@SelectorNoDefault@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2432	0x140029a34
?Initialize@SemanticZoomToggle@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2433	0x140026978
?Initialize@TableLayout@DirectUI@@QEAAXHHHPEAH@Z	2434	0x14003bcb4
?Initialize@TextGraphic@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2435	0x140014888
?Initialize@Thumb@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2436	0x14003b048
?Initialize@TouchButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2437	0x14002b4c8
?Initialize@TouchCheckBox@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2438	0x140014a84
?Initialize@TouchCheckBoxGlyph@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2439	0x14001888c
?Initialize@TouchCommandButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2440	0x140002254
?Initialize@TouchEdit2@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2441	0x140025f74
?Initialize@TouchHWNDElement@DirectUI@@QEAAJPEAUHWND__@@_NIPEAVElement@2@PEAK@Z	2442	0x1400253a8
?Initialize@TouchRepeatButton@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2443	0x140011b3c
?Initialize@TouchScrollBar@DirectUI@@QEAAJ_NPEAVElement@2@PEAK@Z	2444	0x14000cd30
?Initialize@TouchSelect@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2445	0x14004146c
?Initialize@TouchSlider@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2446	0x14003c4d8
?Initialize@TouchSwitch@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2447	0x14001c97c
?Initialize@UnknownElement@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2448	0x14003f970
?Initialize@VerticalFlowLayout@DirectUI@@QEAAX_NIII@Z	2449	0x14001ef70
?Initialize@Viewer@DirectUI@@QEAAJPEAVElement@2@PEAK@Z	2450	0x14003db14
?Initialize@XBaby@DirectUI@@IEAAJPEAVIXElementCP@2@PEAVXProvider@2@PEAUHWND__@@PEAVElement@2@PEAK@Z	2451	0x14000a0e8
?Initialize@XElement@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z	2452	0x14001c98c
?Initialize@XHost@DirectUI@@QEAAJPEAVIXElementCP@2@@Z	2453	0x14001fc9c
?Initialize@XProvider@DirectUI@@QEAAJPEAVElement@2@PEAVIXProviderCP@2@@Z	2454	0x14002bf6c
?Initialize@XResourceProvider@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG11@Z	2455	0x140030eac
?InitializeDllInfo@CallstackTracker@DirectUI@@CAHXZ	2456	0x140040418
?InitializeParserFromXmlReader@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUHINSTANCE__@@1@Z	2457	0x1400028a0
?InitializeSymbols@CallstackTracker@DirectUI@@CAHXZ	2458	0x140029858
?InnerBorderThicknessProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	2459	0x14000f208
?Insert@Element@DirectUI@@QEAAJPEAV12@I@Z	2460	0x140013e34
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z	2461	0x140016758
?Insert@TouchCheckBox@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2462	0x14001d374
?Insert@TouchCheckBoxGlyph@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2463	0x14002fbc8
?Insert@TouchCommandButton@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2464	0x14001d578
?Insert@TouchEditBase@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2465	0x140020978
?Insert@TouchSelect@DirectUI@@UEAAJPEAPEAVElement@2@II@Z	2466	0x140031b10
?InsertItem@CCTreeView@DirectUI@@QEAAPEAU_TREEITEM@@PEAGIQEAU3@1@Z	2467	0x1400188b4
?InsertItem@CCTreeView@DirectUI@@QEAAPEAU_TREEITEM@@PEBUtagTVINSERTSTRUCTW@@@Z	2468	0x14002cd78
?IntegrateIMECandidateListProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2469	0x140021bf8
?InteractionEnd@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	2470	0x140011d08
?InteractionStart@TouchScrollBar@DirectUI@@SA?AVUID@@XZ	2471	0x1400320a0
?InternalCreate@TableLayout@DirectUI@@SAJHHHPEAHPEAPEAVLayout@2@@Z	2472	0x140010608
?InterpolationModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	2473	0x14000e24c
?Invoke@DuiAccessible@DirectUI@@UEAAJJAEBU_GUID@@KGPEAUtagDISPPARAMS@@PEAUtagVARIANT@@PEAUtagEXCEPINFO@@PEAI@Z	2474	0x14003e7d8
?Invoke@InvokeProvider@DirectUI@@UEAAJXZ	2475	0x14002b008
?Invoke@Proxy@DirectUI@@IEAAXIPEAX@Z	2476	0x140021168
?InvokeAnimation@Element@DirectUI@@QEAAXHI@Z	2477	0x14001b1a0
?InvokeAnimation@Element@DirectUI@@QEAAXIIMM_N@Z	2478	0x14003b544
?InvokeInvokedEvent@Schema@DirectUI@@2HA	2479	0x1400171e8
?InvokePattern@Schema@DirectUI@@2HA	2480	0x1400314a8
?IsActivityOccuring@ModernProgressBar@DirectUI@@QEAA_NXZ	2481	0x1400307f4
?IsActivityOccuring@ModernProgressRing@DirectUI@@QEAA_NXZ	2482	0x140007528
?IsAddLayeredRef@ModernProgressBar@DirectUI@@QEAA_NXZ	2483	0x140031da8
?IsAddLayeredRef@ModernProgressRing@DirectUI@@QEAA_NXZ	2484	0x14001ec50
?IsAutoHeight@ModernProgressBar@DirectUI@@QEAA_NXZ	2485	0x14001b448
?IsBehaviorLayout@Element@DirectUI@@QEBA_NXZ	2486	0x14000e204
?IsButtonEnabledAndVisible@DialogElementCore@DirectUI@@KA_NPEAVElement@2@@Z	2487	0x140028b58
?IsCacheDirty@Layout@DirectUI@@IEAA_NXZ	2488	0x140035b40
?IsCompositedText@Element@DirectUI@@QEAA_NXZ	2489	0x140003458
?IsContentElementProperty@Schema@DirectUI@@2HA	2490	0x140019630
?IsContentProtected@Edit@DirectUI@@UEAA_NXZ	2491	0x1400040a8
?IsContentProtected@Element@DirectUI@@UEAA_NXZ	2492	0x14000e0fc
?IsContentProtected@TouchEditBase@DirectUI@@UEAA_NXZ	2493	0x14001fb5c
?IsContinuousProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2494	0x14001d31c
?IsControlElementProperty@Schema@DirectUI@@2HA	2495	0x140021778
?IsCorrectImageHlpVersion@CallstackTracker@DirectUI@@CAHXZ	2496	0x140009e6c
?IsCrossfadeInProgress@TouchScrollViewer@DirectUI@@QEAA_NXZ	2497	0x14000b2b0
?IsDefaultCAlign@Element@DirectUI@@QEAA_NXZ	2498	0x14001e088
?IsDefaultCursor@Element@DirectUI@@QEAA_NXZ	2499	0x140015c6c
?IsDescendent@Element@DirectUI@@QEAA_NPEAV12@@Z	2500	0x14002b1a0
?IsDescendent@XElement@DirectUI@@QEAA_NPEAVElement@2@@Z	2501	0x140023e48
?IsDescendent@XProvider@DirectUI@@UEAAJPEAVElement@2@PEA_N@Z	2502	0x140006bf4
?IsDestroyed@Element@DirectUI@@QEAA_NXZ	2503	0x140027720
?IsDeterminate@ModernProgressBar@DirectUI@@QEAA_NXZ	2504	0x140033190
?IsDynamicScaled@Value@DirectUI@@QEAA_NXZ	2505	0x14001c008
?IsDynamicScaling@DUIXmlParser@DirectUI@@QEAA_NXZ	2506	0x14001710c
?IsEnabledProperty@Schema@DirectUI@@2HA	2507	0x140025700
?IsEqual@Value@DirectUI@@QEAA_NPEAV12@@Z	2508	0x140008ee0
?IsFirstElement@HWNDElement@DirectUI@@QEAA_NPEAVElement@2@@Z	2509	0x140039ed4
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ	2510	0x140017994
?IsHosted@Element@DirectUI@@QEAA_NXZ	2511	0x1400348fc
?IsIndependentAnimations@ModernProgressBar@DirectUI@@QEAA_NXZ	2512	0x140015514
?IsKeyboardFocusableProperty@Schema@DirectUI@@2HA	2513	0x14000bbe8
?IsLastElement@HWNDElement@DirectUI@@QEAA_NPEAVElement@2@@Z	2514	0x14000c6d0
?IsMSAAEnabled@HWNDElement@DirectUI@@UEAA_NXZ	2515	0x140024570
?IsMSAAEnabled@TouchHWNDElement@DirectUI@@UEAA_NXZ	2516	0x14002c424
?IsManualVisualSwapInProgress@TouchScrollViewer@DirectUI@@QEAA_NXZ	2517	0x140034f30
?IsMoveDeferred@HWNDHost@DirectUI@@IEAA_NXZ	2518	0x140025b48
?IsOffscreen@Schema@DirectUI@@2HA	2519	0x140019e40
?IsPasswordProperty@Schema@DirectUI@@2HA	2520	0x140008c04
?IsPatternSupported@ElementProxy@DirectUI@@IEAAJW4Pattern@Schema@2@PEA_N@Z	2521	0x140013190
?IsPatternSupported@ExpandCollapseProxy@DirectUI@@SA_NPEAVElement@2@@Z	2522	0x14000f598
?IsPatternSupported@GridItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2523	0x14003a9a4
?IsPatternSupported@GridProxy@DirectUI@@SA_NPEAVElement@2@@Z	2524	0x140021114
?IsPatternSupported@InvokeProxy@DirectUI@@SA_NPEAVElement@2@@Z	2525	0x1400374f8
?IsPatternSupported@RangeValueProxy@DirectUI@@SA_NPEAVElement@2@@Z	2526	0x140002044
?IsPatternSupported@ScrollItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2527	0x140013934
?IsPatternSupported@ScrollProxy@DirectUI@@SA_NPEAVElement@2@@Z	2528	0x1400109c4
?IsPatternSupported@SelectionItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2529	0x14002cdcc
?IsPatternSupported@SelectionProxy@DirectUI@@SA_NPEAVElement@2@@Z	2530	0x1400171b8
?IsPatternSupported@TableItemProxy@DirectUI@@SA_NPEAVElement@2@@Z	2531	0x14003796c
?IsPatternSupported@TableProxy@DirectUI@@SA_NPEAVElement@2@@Z	2532	0x14002b050
?IsPatternSupported@ToggleProxy@DirectUI@@SA_NPEAVElement@2@@Z	2533	0x14001c350
?IsPatternSupported@ValueProxy@DirectUI@@SA_NPEAVElement@2@@Z	2534	0x140032340
?IsPeripheral@Schema@DirectUI@@2HA	2535	0x140041144
?IsPinned@BaseScrollBar@DirectUI@@QEAA_NXZ	2536	0x140036ef8
?IsPointValid@Element@DirectUI@@AEAA_NNN@Z	2537	0x140008ed8
?IsPopupOpen@TouchSelect@DirectUI@@QEAA_NXZ	2538	0x140038948
?IsPressedProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2539	0x140004c18
?IsRTL@Element@DirectUI@@QEAA_NXZ	2540	0x14002b480
?IsRTLReading@Element@DirectUI@@UEAA_NXZ	2541	0x14003aa18
?IsRegisteredForAnimationStatusChanges@TouchHWNDElement@DirectUI@@QEAA_NXZ	2542	0x14000d068
?IsReorderable@ItemList@DirectUI@@QEAA_NXZ	2543	0x1400161c4
?IsRoot@Element@DirectUI@@QEAAHXZ	2544	0x140011d54
?IsScrollable@BaseScrollBar@DirectUI@@QEAA_NXZ	2545	0x1400314fc
?IsSelfLayout@Element@DirectUI@@QEAA_NXZ	2546	0x1400282ec
?IsShowOnOffFeedbackProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2547	0x14002992c
?IsSmoothFillAnimation@ModernProgressBar@DirectUI@@QEAA_NXZ	2548	0x14000a9b0
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z	2549	0x14000562c
?IsThemeClassName@DUIXmlParser@DirectUI@@KA_NPEBUExprNode@ParserTools@2@@Z	2550	0x14002264c
?IsThumbActive@TouchScrollBar@DirectUI@@QEAA_NXZ	2551	0x14003c4f4
?IsTileMember@TouchScrollViewer@DirectUI@@QEAA_NIPEAVElement@2@@Z	2552	0x14003ca0c
?IsValidAccessor@Element@DirectUI@@QEAA_NPEBUPropertyInfo@2@H_N@Z	2553	0x14001d7f0
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z	2554	0x140017c84
?IsValidValue@Element@DirectUI@@SA_NPEBUPropertyInfo@2@PEAVValue@2@@Z	2555	0x14000fe84
?IsVerticalProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2556	0x14003cf74
?IsWordWrap@Element@DirectUI@@QEAA_NXZ	2557	0x14003ae70
?ItemContainerPattern@Schema@DirectUI@@2HA	2558	0x14003fdd0
?ItemHeightInPopupProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	2559	0x14000c0e8
?ItemStatusProperty@Schema@DirectUI@@2HA	2560	0x14000101c
?ItemTypeProperty@Schema@DirectUI@@2HA	2561	0x140009a38
?KeyFocusedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2562	0x140032c94
?KeyWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2563	0x14002e8ac
?KeyboardNavigate@Element@DirectUI@@SA?AVUID@@XZ	2564	0x140021fe4
?KeyboardNavigationCaptureProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2565	0x1400083fc
?LabeledByProperty@Schema@DirectUI@@2HA	2566	0x140023918
?LastDSConstProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2567	0x140001814
?LayoutInvalidatedEvent@Schema@DirectUI@@2HA	2568	0x1400320a0
?LayoutPosProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2569	0x140034b48
?LayoutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2570	0x14001cf00
?Leaving@Browser@DirectUI@@SA?AVUID@@XZ	2571	0x140010d68
?LightDismissIHMProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	2572	0x140002464
?LineDown@BaseScrollBar@DirectUI@@UEAAXI@Z	2573	0x1400083bc
?LineDown@TouchScrollBar@DirectUI@@UEAAXI@Z	2574	0x14001f168
?LineProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2575	0x14002bca0
?LineProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2576	0x140003794
?LineSizeProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2577	0x140013504
?LineSpacingProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2578	0x14003e140
?LineUp@BaseScrollBar@DirectUI@@UEAAXI@Z	2579	0x140036b90
?LineUp@TouchScrollBar@DirectUI@@UEAAXI@Z	2580	0x140014cc8
?ListControlType@Schema@DirectUI@@2HA	2581	0x140025430
?ListItemControlType@Schema@DirectUI@@2HA	2582	0x1400162b8
?LoadComCtl32@TaskPage@DirectUI@@AEAAJXZ	2583	0x14001c1dc
?LoadCommonControlExports@AnimationStrip@DirectUI@@AEAAJXZ	2584	0x14002874c
?LoadFromBuffer@DUIFactory@DirectUI@@QEAAJPEBG_K0PEAVElement@2@PEAKPEAPEAV32@@Z	2585	0x14003dd9c
?LoadFromFile@DUIFactory@DirectUI@@QEAAJPEBG0PEAVElement@2@PEAKPEAPEAV32@@Z	2586	0x14000e0d8
?LoadFromPath@Movie@DirectUI@@QEAAJPEBG@Z	2587	0x14000578c
?LoadFromResource@DUIFactory@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG1PEAVElement@2@PEAKPEAPEAV42@1@Z	2588	0x140032664
?LoadFromResource@Movie@DirectUI@@QEAAJPEAUHINSTANCE__@@H@Z	2589	0x14003de70
?LoadImagesIntoAnimationStrip@AnimationStrip@DirectUI@@IEAAJXZ	2590	0x140039db0
?LoadPage@TaskPage@DirectUI@@AEAAJPEAPEAVElement@2@PEAV32@PEAPEAVDUIXmlParser@2@@Z	2591	0x14002ecc8
?LoadPage@TaskPage@DirectUI@@MEAAJPEAVHWNDElement@2@PEAUHINSTANCE__@@PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z	2592	0x140005d18
?LoadParser@TaskPage@DirectUI@@MEAAJPEAPEAVDUIXmlParser@2@@Z	2593	0x140040edc
?LocaleProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2594	0x14003d384
?LocalizedControlTypeProperty@Schema@DirectUI@@2HA	2595	0x140032ba4
?Locate@RefPointElement@DirectUI@@SAPEAV12@PEAVElement@2@@Z	2596	0x14002d4f4
?LocationProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2597	0x14003674c
?LookupAccessibleRole@Schema@DirectUI@@SAHHPEA_N@Z	2598	0x140008c1c
?LookupControlInfos@Schema@DirectUI@@CAJXZ	2599	0x140007c78
?LookupElement@DUIXmlParser@DirectUI@@QEAAJPEAUIXmlReader@@PEBGPEAUHINSTANCE__@@PEAPEAUIClassInfo@2@@Z	2600	0x140011f04
?LookupElement@DUIXmlParser@DirectUI@@QEAAJULINEINFO@2@PEBGPEAUHINSTANCE__@@PEAPEAUIClassInfo@2@@Z	2601	0x14000eff8
?LookupEventInfos@Schema@DirectUI@@CAJXZ	2602	0x14002fc4c
?LookupPatternInfos@Schema@DirectUI@@CAJXZ	2603	0x140008454
?LookupPropertyInfos@Schema@DirectUI@@CAJXZ	2604	0x140011b98
?ManipulationCompleted@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2605	0x14000c104
?ManipulationDelta@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2606	0x14000bcc4
?ManipulationHorizontalAlignmentProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	2607	0x140002c10
?ManipulationStarted@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2608	0x14001df8c
?ManipulationStarting@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2609	0x1400313e0
?ManipulationVerticalAlignmentProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	2610	0x14000eb84
?ManualStoryboardVerify@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2611	0x1400073d0
?MapContentVisuals@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	2612	0x14001beb0
?MapElementPoint@Element@DirectUI@@QEAAXPEAV12@PEBUtagPOINT@@PEAU3@@Z	2613	0x140013bec
?MapPropertyEnumValue@DUIXmlParser@DirectUI@@IEAAJPEBUEnumMap@2@PEBGPEAH@Z	2614	0x14000ad64
?MapPropertyNameToPropertyInfo@DUIXmlParser@DirectUI@@IEAAJULINEINFO@2@PEAUIClassInfo@2@PEBGPEAPEBUPropertyInfo@2@@Z	2615	0x1400393d8
?MapRunsToClustersProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2616	0x14003de68
?MarginProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2617	0x14003a060
?MarkHosted@Element@DirectUI@@IEAAXXZ	2618	0x140038ce8
?MarkNeedsDSUpdate@Element@DirectUI@@QEAAXXZ	2619	0x1400200a8
?MarkSelfLayout@Element@DirectUI@@IEAAXXZ	2620	0x14002de28
?MaxLengthProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	2621	0x1400085f8
?MaxLengthProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2622	0x1400084c0
?MaximumProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2623	0x140029510
?MaximumProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2624	0x1400016e8
?MaximumProp@Progress@DirectUI@@SAPEBUPropertyInfo@2@XZ	2625	0x140009e14
?MaximumProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2626	0x140033ca4
?MenuBarControlType@Schema@DirectUI@@2HA	2627	0x14001f980
?MenuClosedEvent@Schema@DirectUI@@2HA	2628	0x14002338c
?MenuControlType@Schema@DirectUI@@2HA	2629	0x14003dc98
?MenuItemControlType@Schema@DirectUI@@2HA	2630	0x14000a504
?MenuOpenedEvent@Schema@DirectUI@@2HA	2631	0x14001b06c
?MessageCallback@Edit@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2632	0x140032f74
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2633	0x140028604
?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2634	0x140002a58
?MessageCallback@TouchHWNDElement@DirectUI@@UEAAIPEAUtagGMSG@@@Z	2635	0x14002f9ec
?MeteringProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	2636	0x14002db78
?MinSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2637	0x14000c774
?MinimumProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2638	0x140016a2c
?MinimumProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2639	0x140014210
?MinimumProp@Progress@DirectUI@@SAPEBUPropertyInfo@2@XZ	2640	0x14002c7bc
?MinimumProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2641	0x1400200c0
?MonitorPowerSettingsChange@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	2642	0x1400133f4
?MouseFocusedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2643	0x14002bf0c
?MouseOrPointerReleased@TouchSlider@DirectUI@@SA?AVUID@@XZ	2644	0x14002f888
?MouseWithinProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2645	0x1400362d4
?MoveCaretToEndOnSyncContentProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2646	0x14004155c
?MultilineProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	2647	0x14002406c
?MultilineProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	2648	0x140022164
?MultipleClick@TouchButton@DirectUI@@SA?AVUID@@XZ	2649	0x14001095c
?MultipleViewPattern@Schema@DirectUI@@2HA	2650	0x140018854
?NameProperty@Schema@DirectUI@@2HA	2651	0x1400122ec
?Navigate@DuiNavigate@DirectUI@@SAPEAVElement@2@PEAV32@PEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@H@Z	2652	0x140004960
?Navigate@ElementProvider@DirectUI@@UEAAJW4NavigateDirection@@PEAPEAUIRawElementProviderFragment@@@Z	2653	0x14003c04c
?Navigate@ElementProxy@DirectUI@@IEAAJW4NavigateDirection@@PEAPEAUIRawElementProviderFragment@@@Z	2654	0x140039208
?Navigate@XProvider@DirectUI@@UEAAJHPEA_N@Z	2655	0x140024528
?NeedsDSUpdate@Element@DirectUI@@QEAA_NXZ	2656	0x1400330e8
?NewChildElementsAdded@TouchScrollViewer@DirectUI@@QEAAXXZ	2657	0x14000b698
?NewNativeWindowHandleProperty@Schema@DirectUI@@2HA	2658	0x14001b0f8
?Next@DuiAccessible@DirectUI@@UEAAJKPEAUtagVARIANT@@PEAK@Z	2659	0x14002de94
?Next@HWNDHostAccessible@DirectUI@@UEAAJKPEAUtagVARIANT@@PEAK@Z	2660	0x14003b588
?NoteProp@CCCommandLink@DirectUI@@SAPEBUPropertyInfo@2@XZ	2661	0x14002c554
?NotifyComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2662	0x140007174
?NotifyImplicit@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2663	0x140031650
?NotifyStart@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2664	0x14000fca0
?NotifyStoryboardComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ	2665	0x14002e28c
?NullControlType@Schema@DirectUI@@2HA	2666	0x14001d2c8
?OffTextProp@TouchSwitch@DirectUI@@SAPEBUPropertyInfo@2@XZ	2667	0x14003c6ac
?OnAction@AnimationStrip@DirectUI@@IEAAXPEAUGMA_ACTIONINFO@@@Z	2668	0x140009710
?OnAdd@BorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2669	0x140014340
?OnAdd@Layout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2670	0x14002b784
?OnAdd@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2671	0x14003f4a0
?OnAdd@ShellBorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2672	0x14003d464
?OnAdjustWindowSize@Combobox@DirectUI@@UEAAHHHI@Z	2673	0x1400131b0
?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z	2674	0x140023e88
?OnChildLostFocus@DialogElement@DirectUI@@UEAA_NPEAVElement@2@@Z	2675	0x14002720c
?OnChildLostFocus@DialogElementCore@DirectUI@@QEAA_NPEAVElement@2@@Z	2676	0x140014110
?OnChildLostFocus@XBaby@DirectUI@@UEAA_NPEAVElement@2@@Z	2677	0x140024494
?OnChildReceivedFocus@DialogElement@DirectUI@@UEAA_NPEAVElement@2@@Z	2678	0x140008278
?OnChildReceivedFocus@DialogElementCore@DirectUI@@QEAA_NPEAVElement@2@@Z	2679	0x14003a968
?OnChildReceivedFocus@XBaby@DirectUI@@UEAA_NPEAVElement@2@@Z	2680	0x14000f900
?OnCompositionChanged@HWNDElement@DirectUI@@UEAAXXZ	2681	0x140013c8c
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2682	0x14002e6f8
?OnCustomDraw@CCBase@DirectUI@@UEAA_NPEAUtagNMCUSTOMDRAWINFO@@PEA_J@Z	2683	0x140024900
?OnDefaultButtonTrackingChanged@DialogElementCore@DirectUI@@QEAAXPEAVValue@2@@Z	2684	0x140006c14
?OnDestroy@AnimationStrip@DirectUI@@MEAAXXZ	2685	0x1400353e8
?OnDestroy@DialogElement@DirectUI@@UEAAXXZ	2686	0x14002d31c
?OnDestroy@DialogElementCore@DirectUI@@QEAAXXZ	2687	0x140030408
?OnDestroy@Element@DirectUI@@UEAAXXZ	2688	0x14000ba8c
?OnDestroy@HWNDElement@DirectUI@@UEAAXXZ	2689	0x140021700
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ	2690	0x14001fad8
?OnDestroy@ModernProgressBar@DirectUI@@MEAAXXZ	2691	0x14003dccc
?OnDestroy@ModernProgressRing@DirectUI@@MEAAXXZ	2692	0x14000d648
?OnDestroy@Movie@DirectUI@@UEAAXXZ	2693	0x140007ddc
?OnDestroy@TouchHWNDElement@DirectUI@@UEAAXXZ	2694	0x140004fb4
?OnEvent@AutoButton@DirectUI@@UEAAXPEAUEvent@2@@Z	2695	0x1400203d0
?OnEvent@BaseScrollViewer@DirectUI@@UEAAXPEAUEvent@2@@Z	2696	0x140039f8c
?OnEvent@Browser@DirectUI@@UEAAXPEAUEvent@2@@Z	2697	0x140003010
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z	2698	0x14001cf84
?OnEvent@Expando@DirectUI@@UEAAXPEAUEvent@2@@Z	2699	0x14001cb74
?OnEvent@HWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z	2700	0x140018288
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z	2701	0x1400085ec
?OnEvent@Movie@DirectUI@@UEAAXPEAUEvent@2@@Z	2702	0x140005ff4
?OnEvent@Navigator@DirectUI@@UEAAXPEAUEvent@2@@Z	2703	0x140033220
?OnEvent@RichText@DirectUI@@UEAAXPEAUEvent@2@@Z	2704	0x1400308ec
?OnEvent@ScrollBar@DirectUI@@UEAAXPEAUEvent@2@@Z	2705	0x14001e924
?OnEvent@Selector@DirectUI@@UEAAXPEAUEvent@2@@Z	2706	0x14000d9d4
?OnEvent@SelectorNoDefault@DirectUI@@UEAAXPEAUEvent@2@@Z	2707	0x14002c300
?OnEvent@TouchButton@DirectUI@@UEAAXPEAUEvent@2@@Z	2708	0x1400275bc
?OnEvent@TouchCheckBox@DirectUI@@UEAAXPEAUEvent@2@@Z	2709	0x140037398
?OnEvent@TouchEdit2@DirectUI@@UEAAXPEAUEvent@2@@Z	2710	0x14002d524
?OnEvent@TouchHWNDElement@DirectUI@@UEAAXPEAUEvent@2@@Z	2711	0x14001dd5c
?OnEvent@TouchScrollBar@DirectUI@@UEAAXPEAUEvent@2@@Z	2712	0x1400099dc
?OnEvent@TouchSelect@DirectUI@@UEAAXPEAUEvent@2@@Z	2713	0x14000fdb0
?OnEvent@Viewer@DirectUI@@UEAAXPEAUEvent@2@@Z	2714	0x14001cfac
?OnEvent@XBaby@DirectUI@@UEAAXPEAUEvent@2@@Z	2715	0x14000fa18
?OnEvent@XElement@DirectUI@@UEAAXPEAUEvent@2@@Z	2716	0x140001ae0
?OnGetDlgCode@DialogElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z	2717	0x14002a448
?OnGetDlgCode@DialogElementCore@DirectUI@@QEAAXPEAUtagMSG@@PEA_J@Z	2718	0x140004684
?OnGetDlgCode@HWNDElement@DirectUI@@UEAAXPEAUtagMSG@@PEA_J@Z	2719	0x14000cabc
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z	2720	0x140031504
?OnGroupChanged@HWNDElement@DirectUI@@UEAAXH_N@Z	2721	0x1400370f8
?OnHosted@Combobox@DirectUI@@UEAAXPEAVElement@2@@Z	2722	0x14002f808
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z	2723	0x140006cc4
?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z	2724	0x140032f68
?OnHosted@ModernProgressBar@DirectUI@@MEAAXPEAVElement@2@@Z	2725	0x1400247d8
?OnHosted@ModernProgressRing@DirectUI@@MEAAXPEAVElement@2@@Z	2726	0x1400131f0
?OnHosted@Movie@DirectUI@@UEAAXPEAVElement@2@@Z	2727	0x1400037ec
?OnHosted@PushButton@DirectUI@@UEAAXPEAVElement@2@@Z	2728	0x140017a1c
?OnHosted@RichText@DirectUI@@UEAAXPEAVElement@2@@Z	2729	0x14000c604
?OnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z	2730	0x14002f30c
?OnHosted@TouchEdit2@DirectUI@@UEAAXPEAVElement@2@@Z	2731	0x140035b54
?OnHosted@TouchScrollBar@DirectUI@@UEAAXPEAVElement@2@@Z	2732	0x1400266ac
?OnHosted@TouchSelect@DirectUI@@UEAAXPEAVElement@2@@Z	2733	0x14000b714
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UEAAXXZ	2734	0x140025070
?OnInput@BaseScrollViewer@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2735	0x14001cd20
?OnInput@Button@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2736	0x140022430
?OnInput@CCBase@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2737	0x140008b70
?OnInput@CCCheckBox@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2738	0x140041744
?OnInput@CCProgressBar@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2739	0x14001e2e0
?OnInput@CCPushButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2740	0x14003ff68
?OnInput@CCRadioButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2741	0x140026140
?OnInput@CCSysLink@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2742	0x1400177e4
?OnInput@Combobox@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2743	0x140030808
?OnInput@DialogElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2744	0x140025a3c
?OnInput@DialogElementCore@DirectUI@@QEAAXPEAUInputEvent@2@@Z	2745	0x140026e34
?OnInput@Edit@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2746	0x1400079f8
?OnInput@Element@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2747	0x1400018e0
?OnInput@HWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2748	0x14002917c
?OnInput@HWNDHost@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2749	0x14000293c
?OnInput@RepeatButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2750	0x14000a92c
?OnInput@Selector@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2751	0x14003fd34
?OnInput@Thumb@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2752	0x140031374
?OnInput@TouchButton@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2753	0x140018ca8
?OnInput@TouchEdit2@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2754	0x140009a78
?OnInput@TouchHWNDElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2755	0x14001b884
?OnInput@TouchScrollBar@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2756	0x140030f68
?OnInput@TouchSelect@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2757	0x140021c28
?OnInput@Viewer@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2758	0x14003433c
?OnInput@XElement@DirectUI@@UEAAXPEAUInputEvent@2@@Z	2759	0x140036cf0
?OnInvoke@InvokeHelper@DirectUI@@AEAAXPEAUInvokeArgs@12@@Z	2760	0x140001830
?OnInvoke@Proxy@DirectUI@@MEAAXIPEAX@Z	2761	0x140026d10
?OnKeyFocusMoved@DialogElement@DirectUI@@UEAAXPEAVElement@2@0@Z	2762	0x1400239f4
?OnKeyFocusMoved@DialogElementCore@DirectUI@@QEAAXPEAVElement@2@0@Z	2763	0x14001da64
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z	2764	0x14000f318
?OnKeyFocusMoved@Selector@DirectUI@@UEAAXPEAVElement@2@0@Z	2765	0x1400142b8
?OnKeyFocusMoved@SelectorNoDefault@DirectUI@@UEAAXPEAVElement@2@0@Z	2766	0x14000f57c
?OnKeyFocusMoved@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@0@Z	2767	0x14000afc0
?OnKillActive@TaskPage@DirectUI@@MEAA_JXZ	2768	0x14000d770
?OnLayoutPosChanged@BorderLayout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2769	0x1400365fc
?OnLayoutPosChanged@Layout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2770	0x14000d324
?OnLayoutPosChanged@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2771	0x140026c54
?OnLayoutPosChanged@ShellBorderLayout@DirectUI@@UEAAXPEAVElement@2@0HH@Z	2772	0x140034f94
?OnListenedEvent@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEAUEvent@2@@Z	2773	0x14003d91c
?OnListenedEvent@DialogElement@DirectUI@@UEAAXPEAVElement@2@PEAUEvent@2@@Z	2774	0x14003cb8c
?OnListenedEvent@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEAUEvent@2@@Z	2775	0x140027aa8
?OnListenedInput@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEAUInputEvent@2@@Z	2776	0x14000fbb8
?OnListenedInput@DialogElement@DirectUI@@UEAAXPEAVElement@2@PEAUInputEvent@2@@Z	2777	0x140025258
?OnListenedInput@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEAUInputEvent@2@@Z	2778	0x1400211b0
?OnListenedPropertyChanged@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2779	0x140005dd0
?OnListenedPropertyChanged@DialogElement@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2780	0x1400030b0
?OnListenedPropertyChanged@ScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2781	0x14000df54
?OnListenedPropertyChanged@StyledScrollViewer@DirectUI@@UEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2782	0x140034b3c
?OnListenedPropertyChanged@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2783	0x14003b9c0
?OnListenedPropertyChanged@TouchEdit2@DirectUI@@EEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2784	0x14002737c
?OnListenedPropertyChanging@BaseScrollViewer@DirectUI@@UEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2785	0x140001314
?OnListenedPropertyChanging@DialogElement@DirectUI@@UEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2786	0x140005f2c
?OnListenedPropertyChanging@TaskPage@DirectUI@@MEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	2787	0x1400097c0
?OnListenerAttach@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@@Z	2788	0x14001554c
?OnListenerAttach@DialogElement@DirectUI@@UEAAXPEAVElement@2@@Z	2789	0x140008098
?OnListenerAttach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z	2790	0x14000d87c
?OnListenerDetach@BaseScrollViewer@DirectUI@@UEAAXPEAVElement@2@@Z	2791	0x140024ba8
?OnListenerDetach@DialogElement@DirectUI@@UEAAXPEAVElement@2@@Z	2792	0x140033998
?OnListenerDetach@DialogElementCore@DirectUI@@QEAAXPEAVElement@2@@Z	2793	0x14003f05c
?OnListenerDetach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z	2794	0x14002e4d4
?OnListenerDetach@TouchEdit2@DirectUI@@EEAAXPEAVElement@2@@Z	2795	0x140022548
?OnLostDialogFocus@Button@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2796	0x14002d640
?OnLostDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2797	0x14001fa48
?OnLostDialogFocus@CCBaseCheckRadioButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2798	0x14000aa8c
?OnLostDialogFocus@CCPushButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2799	0x1400036b8
?OnLostDialogFocus@CCSysLink@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2800	0x140016c34
?OnLostDialogFocus@CheckBoxGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2801	0x14003cf34
?OnLostDialogFocus@ExpandoButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2802	0x14001e3a8
?OnLostDialogFocus@RadioButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2803	0x14002c5d4
?OnMaximumChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2804	0x1400106d4
?OnMessage@CCBaseScrollBar@DirectUI@@UEAA_NI_K_JPEA_J@Z	2805	0x1400061b0
?OnMessage@CCPushButton@DirectUI@@UEAA_NI_K_JPEA_J@Z	2806	0x14002bd48
?OnMessage@CCTrackBar@DirectUI@@UEAA_NI_K_JPEA_J@Z	2807	0x14002ed88
?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2808	0x14000cc04
?OnMessage@NativeHWNDHost@DirectUI@@UEAAJI_K_JPEA_J@Z	2809	0x140011d78
?OnMessage@TaskPage@DirectUI@@MEAA_NI_K_JPEA_J@Z	2810	0x140025ef4
?OnMessage@XElement@DirectUI@@UEAA_NI_K_JPEA_J@Z	2811	0x140006648
?OnMinimumChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2812	0x140035740
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z	2813	0x140006b8c
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z	2814	0x140022328
?OnNoChildWithShortcutFound@XBaby@DirectUI@@UEAAXPEAUKeyboardEvent@2@@Z	2815	0x14002f314
?OnNotify@CCBase@DirectUI@@UEAA_NI_K_JPEA_J@Z	2816	0x1400307b4
?OnNotify@CCCheckBox@DirectUI@@UEAA_NI_K_JPEA_J@Z	2817	0x140037a4c
?OnNotify@CCPushButton@DirectUI@@UEAA_NI_K_JPEA_J@Z	2818	0x14003e8ac
?OnNotify@CCRadioButton@DirectUI@@UEAA_NI_K_JPEA_J@Z	2819	0x140003444
?OnNotify@CCTreeView@DirectUI@@UEAA_NI_K_JPEA_J@Z	2820	0x14001fc50
?OnNotify@Combobox@DirectUI@@UEAA_NI_K_JPEA_J@Z	2821	0x14001deb0
?OnNotify@Edit@DirectUI@@UEAA_NI_K_JPEA_J@Z	2822	0x140037e9c
?OnNotify@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2823	0x1400294c0
?OnPageChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2824	0x140002bdc
?OnPageChanging@BaseScrollBar@DirectUI@@QEAA_NPEAVValue@2@@Z	2825	0x1400415a4
?OnPositionChanged@BaseScrollBar@DirectUI@@QEAAXPEAVValue@2@@Z	2826	0x1400127e8
?OnPositionChanging@BaseScrollBar@DirectUI@@QEAA_NPEAVValue@2@@Z	2827	0x14000ac9c
?OnPropertyChanged@AccessibleButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2828	0x14001b1cc
?OnPropertyChanged@AnimationStrip@DirectUI@@MEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2829	0x140024d2c
?OnPropertyChanged@BaseScrollViewer@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2830	0x14003f054
?OnPropertyChanged@Browser@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2831	0x140021bbc
?OnPropertyChanged@Button@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2832	0x140037cc4
?OnPropertyChanged@CCBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2833	0x140036d9c
?OnPropertyChanged@CCBaseCheckRadioButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2834	0x1400081a8
?OnPropertyChanged@CCBaseScrollBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2835	0x14002ab14
?OnPropertyChanged@CCCommandLink@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2836	0x1400231e4
?OnPropertyChanged@CCPushButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2837	0x14002c440
?OnPropertyChanged@CCTrackBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2838	0x14000bc04
?OnPropertyChanged@Combobox@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2839	0x14002a1f8
?OnPropertyChanged@DialogElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2840	0x14001f5e4
?OnPropertyChanged@Edit@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2841	0x14002b20c
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z	2842	0x14002807c
?OnPropertyChanged@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2843	0x140005228
?OnPropertyChanged@Expando@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2844	0x1400272ec
?OnPropertyChanged@HWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2845	0x14000753c
?OnPropertyChanged@HWNDHost@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2846	0x14001edf4
?OnPropertyChanged@ItemList@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2847	0x140001b90
?OnPropertyChanged@Macro@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2848	0x140009678
?OnPropertyChanged@ModernProgressBar@DirectUI@@MEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2849	0x1400260fc
?OnPropertyChanged@ModernProgressRing@DirectUI@@MEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2850	0x140017a2c
?OnPropertyChanged@RefPointElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2851	0x14001ebb8
?OnPropertyChanged@RichText@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2852	0x140010d8c
?OnPropertyChanged@ScrollBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2853	0x14000251c
?OnPropertyChanged@ScrollViewer@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2854	0x14000d360
?OnPropertyChanged@Selector@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2855	0x140016564
?OnPropertyChanged@TextGraphic@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2856	0x14002c4cc
?OnPropertyChanged@TouchButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2857	0x14002a7bc
?OnPropertyChanged@TouchCheckBox@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2858	0x1400346c4
?OnPropertyChanged@TouchCommandButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2859	0x140014a30
?OnPropertyChanged@TouchEdit2@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2860	0x140021320
?OnPropertyChanged@TouchEditBase@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2861	0x140015e90
?OnPropertyChanged@TouchHWNDElement@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2862	0x1400235f4
?OnPropertyChanged@TouchHyperLink@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2863	0x14001c0b8
?OnPropertyChanged@TouchRepeatButton@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2864	0x140012d98
?OnPropertyChanged@TouchScrollBar@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2865	0x1400361fc
?OnPropertyChanged@TouchSelect@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2866	0x140022cc4
?OnPropertyChanged@Viewer@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2867	0x14002de80
?OnPropertyChanging@BaseScrollViewer@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2868	0x1400199c4
?OnPropertyChanging@CCBaseScrollBar@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2869	0x14003d320
?OnPropertyChanging@CCTrackBar@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2870	0x140028a24
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z	2871	0x14002ae48
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2872	0x14002db14
?OnPropertyChanging@PText@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2873	0x14002a340
?OnPropertyChanging@ScrollBar@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2874	0x14000c2c8
?OnPropertyChanging@TextGraphic@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2875	0x14003926c
?OnPropertyChanging@TouchCheckBox@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2876	0x140020bcc
?OnPropertyChanging@TouchCheckBoxGlyph@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2877	0x140019cb8
?OnPropertyChanging@TouchCommandButton@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2878	0x1400127fc
?OnPropertyChanging@TouchEdit2@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2879	0x1400046ec
?OnPropertyChanging@TouchEditBase@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2880	0x14001f7dc
?OnPropertyChanging@TouchSelect@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2881	0x140026bcc
?OnPropertyChanging@Viewer@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z	2882	0x14001efd8
?OnQueryCancel@TaskPage@DirectUI@@MEAA_JXZ	2883	0x14003b0e8
?OnQueryInitialFocus@TaskPage@DirectUI@@MEAAPEAVElement@2@XZ	2884	0x1400206f4
?OnReceivedDialogFocus@Button@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2885	0x1400210f0
?OnReceivedDialogFocus@CCBase@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2886	0x1400347d0
?OnReceivedDialogFocus@CCBaseCheckRadioButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2887	0x14002ad50
?OnReceivedDialogFocus@CCPushButton@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2888	0x14000e840
?OnReceivedDialogFocus@CCSysLink@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2889	0x140020698
?OnReceivedDialogFocus@CheckBoxGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2890	0x140037060
?OnReceivedDialogFocus@ExpandoButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2891	0x14002d6a8
?OnReceivedDialogFocus@RadioButtonGlyph@DirectUI@@UEAA_NPEAUIDialogElement@2@@Z	2892	0x14001f8d0
?OnRegisteredDefaultButtonChanged@DialogElementCore@DirectUI@@QEAAXPEAVValue@2@0@Z	2893	0x14001e964
?OnRemove@BorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2894	0x140010a2c
?OnRemove@Layout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2895	0x1400211dc
?OnRemove@NineGridLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2896	0x140008b78
?OnRemove@ShellBorderLayout@DirectUI@@UEAAXPEAVElement@2@PEAPEAV32@I@Z	2897	0x140015ca4
?OnReset@TaskPage@DirectUI@@MEAA_JXZ	2898	0x140034c68
?OnSelectedPropertyChanged@CCCommandLink@DirectUI@@UEAAXXZ	2899	0x140010c48
?OnSelectedPropertyChanged@CCPushButton@DirectUI@@UEAAXXZ	2900	0x14000a510
?OnSetActive@TaskPage@DirectUI@@MEAA_JXZ	2901	0x14000a310
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z	2902	0x1400308ac
?OnSinkThemeChanged@XElement@DirectUI@@UEAA_NI_K_JPEA_J@Z	2903	0x140020f4c
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z	2904	0x140009394
?OnSysChar@XElement@DirectUI@@UEAA_NG@Z	2905	0x140015188
?OnTextProp@TouchSwitch@DirectUI@@SAPEBUPropertyInfo@2@XZ	2906	0x140020fc8
?OnThemeChanged@HWNDElement@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z	2907	0x1400037d0
?OnThemeChanged@XBaby@DirectUI@@UEAAXPEAUThemeChangedEvent@2@@Z	2908	0x14002b1d4
?OnToolTip@EventManager@DirectUI@@SAJPEAVElement@2@K@Z	2909	0x14002af94
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z	2910	0x1400067d0
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z	2911	0x140026194
?OnUnHosted@ModernProgressBar@DirectUI@@MEAAXPEAVElement@2@@Z	2912	0x14001ccb4
?OnUnHosted@ModernProgressRing@DirectUI@@MEAAXPEAVElement@2@@Z	2913	0x140019b34
?OnUnHosted@PushButton@DirectUI@@UEAAXPEAVElement@2@@Z	2914	0x140017b44
?OnUnHosted@TouchButton@DirectUI@@UEAAXPEAVElement@2@@Z	2915	0x14000e458
?OnUnHosted@TouchSelect@DirectUI@@UEAAXPEAVElement@2@@Z	2916	0x140016364
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z	2917	0x14000b224
?OnWizBack@TaskPage@DirectUI@@MEAA_JXZ	2918	0x14002d0a8
?OnWizFinish@TaskPage@DirectUI@@MEAA_JXZ	2919	0x140025b30
?OnWizNext@TaskPage@DirectUI@@MEAA_JXZ	2920	0x1400104ac
?OnWmSettingChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z	2921	0x140015578
?OnWmThemeChanged@HWNDElement@DirectUI@@UEAAX_K_J@Z	2922	0x14002e728
?OnWmThemeChanged@XBaby@DirectUI@@UEAAX_K_J@Z	2923	0x140010fec
?OnWndMsg@TaskPage@DirectUI@@AEAAHI_K_JPEA_J@Z	2924	0x14001b860
?OpenAnimation@CCAVI@DirectUI@@AEAAXPEAUHWND__@@@Z	2925	0x14000d314
?OpenPopup@TouchSelect@DirectUI@@QEAAJXZ	2926	0x140014928
?OptimizeMoveProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	2927	0x14000d060
?OrderProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2928	0x14001b84c
?Orientation@Schema@DirectUI@@2HA	2929	0x14003092c
?OverhangOffsetProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	2930	0x140022744
?OverhangProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2931	0x14002d33c
?OverrideButtonBackgroundProp@CCPushButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	2932	0x14000a154
?OverrideZoomThreshold@TouchScrollViewer@DirectUI@@QEAAJMMH@Z	2933	0x14003fe78
?PaddingProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2934	0x14001d518
?PageDown@BaseScrollBar@DirectUI@@UEAAXI@Z	2935	0x140034534
?PageDown@TouchScrollBar@DirectUI@@UEAAXI@Z	2936	0x140033ac0
?PageProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2937	0x140030454
?PageProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	2938	0x14001d5e8
?PageUp@BaseScrollBar@DirectUI@@UEAAXI@Z	2939	0x14003c3d8
?PageUp@TouchScrollBar@DirectUI@@UEAAXI@Z	2940	0x14003d4f4
?Paint@AnimationStrip@DirectUI@@MEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2941	0x140010328
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2942	0x140018668
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2943	0x140028134
?Paint@ModernProgressBar@DirectUI@@MEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2944	0x140011f28
?Paint@ModernProgressRing@DirectUI@@MEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2945	0x14003b788
?Paint@Movie@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2946	0x14001c040
?Paint@Progress@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2947	0x14003b4cc
?Paint@RichText@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2948	0x14000888c
?Paint@TouchCheckBox@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2949	0x14001f96c
?Paint@TouchCheckBoxGlyph@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2950	0x140021900
?Paint@TouchCommandButton@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2951	0x140026e2c
?Paint@TouchEdit2@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z	2952	0x140026378
?PaintBackground@Element@DirectUI@@QEAAXPEAUHDC__@@PEAVValue@2@AEBUtagRECT@@222@Z	2953	0x14000c470
?PaintBorder@Element@DirectUI@@QEAAXPEAUHDC__@@PEAVValue@2@PEAUtagRECT@@AEBU5@@Z	2954	0x14002546c
?PaintContent@Element@DirectUI@@QEAAXPEAUHDC__@@PEBUtagRECT@@@Z	2955	0x140005460
?PaintEdgeHighlight@Element@DirectUI@@QEAAXPEAUHDC__@@AEBUtagRECT@@1@Z	2956	0x140003f4c
?PaintFocusRect@Element@DirectUI@@QEAAXPEAUHDC__@@PEBUtagRECT@@1@Z	2957	0x14003390c
?PaintStringContent@Element@DirectUI@@QEAAXPEAUHDC__@@PEBUtagRECT@@PEAVValue@2@H@Z	2958	0x1400319e8
?PaneControlType@Schema@DirectUI@@2HA	2959	0x1400315bc
?ParentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	2960	0x140037898
?ParseARGBColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAKPEA_N@Z	2961	0x140022974
?ParseArgs@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEATParsedArg@12@IPEBD@Z	2962	0x1400166b4
?ParseAtomValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2963	0x140005dfc
?ParseBehavior@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@@Z	2964	0x14001401c
?ParseBehaviorArgValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2965	0x140027014
?ParseBoolValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2966	0x14003ed74
?ParseColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAK@Z	2967	0x14001e7a8
?ParseDFCFill@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2968	0x1400108b4
?ParseDTBFill@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2969	0x14000c744
?ParseDoubleListValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2970	0x140020a18
?ParseFillValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2971	0x140015554
?ParseFloat@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAMPEA_N@Z	2972	0x140010e18
?ParseFloatValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2973	0x140021dd0
?ParseFunction@DUIXmlParser@DirectUI@@IEAAJPEBGPEBUExprNode@ParserTools@2@PEATParsedArg@12@IPEBD@Z	2974	0x140038310
?ParseGTCColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAKPEA_N@Z	2975	0x140038070
?ParseGTFStr@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2976	0x140022560
?ParseGTMarRect@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledRECT@2@PEA_N@Z	2977	0x14001b094
?ParseGTMetInt@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAHPEA_N@Z	2978	0x140015214
?ParseGTPartSize@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledSIZE@2@PEA_N@Z	2979	0x140031c20
?ParseGradientFill@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2980	0x140038014
?ParseGraphicGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2981	0x14000a66c
?ParseGraphicHelper@DUIXmlParser@DirectUI@@IEAAJ_NPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2982	0x14002c49c
?ParseGraphicValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2983	0x140004c64
?ParseIconGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2984	0x140041328
?ParseImageGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	2985	0x14002f18c
?ParseIntValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2986	0x14003fdf4
?ParseLayoutValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@@Z	2987	0x14000b1c0
?ParseLibrary@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAUHINSTANCE__@@@Z	2988	0x14001e200
?ParseLiteral@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEBG@Z	2989	0x14002a690
?ParseLiteralColor@DUIXmlParser@DirectUI@@IEAAJPEBGPEAK@Z	2990	0x140040474
?ParseLiteralColorInt@DUIXmlParser@DirectUI@@IEAAJPEBGPEAH@Z	2991	0x140008fe8
?ParseLiteralNumber@DUIXmlParser@DirectUI@@IEAAJPEBGPEAHPEA_N@Z	2992	0x1400227e4
?ParseMagnitude@DUIXmlParser@DirectUI@@IEAAJPEBGPEAHPEA_N@Z	2993	0x140038a24
?ParseMagnitudeFloat@DUIXmlParser@DirectUI@@IEAAJPEBGPEAMPEA_N@Z	2994	0x14003bcd0
?ParseNumber@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAHPEA_N@Z	2995	0x14002f3f8
?ParsePointValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	2996	0x14000d4dc
?ParseQuotedString@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEBG@Z	2997	0x14002d8c4
?ParseRGBColor@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAKPEA_N@Z	2998	0x140018cd4
?ParseRect@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledRECT@2@@Z	2999	0x1400302e8
?ParseRectRect@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledRECT@2@PEA_N@Z	3000	0x14001ead4
?ParseRectValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3001	0x14000291c
?ParseResStr@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	3002	0x140011e9c
?ParseResid@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEBG@Z	3003	0x140040558
?ParseSGraphicGraphic@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	3004	0x14002ba7c
?ParseSGraphicHelper@DUIXmlParser@DirectUI@@IEAAJ_NPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3005	0x140020748
?ParseSize@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledSIZE@2@@Z	3006	0x14003761c
?ParseSizeSize@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAUScaledSIZE@2@PEA_N@Z	3007	0x1400229c4
?ParseSizeValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3008	0x140011b3c
?ParseStringValue@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@@Z	3009	0x140035ae8
?ParseStyleSheets@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	3010	0x1400359d8
?ParseSysMetricInt@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAHPEA_N@Z	3011	0x14003bc44
?ParseSysMetricStr@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@PEAPEAVValue@2@PEA_N@Z	3012	0x140029648
?ParseTheme@DUIXmlParser@DirectUI@@IEAAJPEBUExprNode@ParserTools@2@_NPEAPEAX@Z	3013	0x140018894
?PasswordCharacterProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	3014	0x14002744c
?PasswordCharacterProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3015	0x14002bcd8
?PasswordRevealModeProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3016	0x14001fde8
?Paste@TouchEditBase@DirectUI@@SA?AVUID@@XZ	3017	0x1400047b4
?PasteText@TouchEdit2@DirectUI@@QEAAJPEBG@Z	3018	0x140020b18
?PathProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3019	0x140024dec
?PatternFromPatternId@Schema@DirectUI@@SA?AW4Pattern@12@H@Z	3020	0x1400348dc
?Pause@Movie@DirectUI@@QEAAXXZ	3021	0x140036a10
?PfnIsSupportedFromPattern@Schema@DirectUI@@SAP6A_NPEAVElement@2@@ZW4Pattern@12@@Z	3022	0x140037fd4
?PinningProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3023	0x14000a830
?PixelOffsetModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3024	0x140040a48
?Play@CCAVI@DirectUI@@QEAAXPEAUHWND__@@@Z	3025	0x140010fe0
?Play@Movie@DirectUI@@QEAAXXZ	3026	0x140027e74
?PlayAllFramesModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3027	0x14003b1cc
?PlayProp@AnimationStrip@DirectUI@@SAPEBUPropertyInfo@2@XZ	3028	0x14002c864
?PopupBoundsProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	3029	0x14003ba8c
?PopupChange@TouchSelect@DirectUI@@SA?AVUID@@XZ	3030	0x14000f824
?PosInLayoutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3031	0x140029cc8
?PositionProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3032	0x140036674
?PositionProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3033	0x140027588
?PositionProp@Progress@DirectUI@@SAPEBUPropertyInfo@2@XZ	3034	0x14002dae0
?PositionProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3035	0x1400166a8
?PostCreate@CCAVI@DirectUI@@MEAAXPEAUHWND__@@@Z	3036	0x14002b75c
?PostCreate@CCBase@DirectUI@@MEAAXPEAUHWND__@@@Z	3037	0x140027cd8
?PostCreate@CCBaseCheckRadioButton@DirectUI@@MEAAXPEAUHWND__@@@Z	3038	0x1400358a4
?PostCreate@CCCommandLink@DirectUI@@MEAAXPEAUHWND__@@@Z	3039	0x14001365c
?PostCreate@CCTrackBar@DirectUI@@MEAAXPEAUHWND__@@@Z	3040	0x14000c78c
?PrepareManualSwapDeferredZoomToRect@TouchScrollViewer@DirectUI@@QEAAJPEBUtagRECT@@PEBM1PEAM2M@Z	3041	0x14002c7d4
?PressedProp@Button@DirectUI@@SAPEBUPropertyInfo@2@XZ	3042	0x140039420
?PressedProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3043	0x1400255d4
?PreventFormatChangeUpdatingModifiedStateProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3044	0x140023634
?PrintRTLControl@HWNDHost@DirectUI@@IEAAXPEAUHDC__@@0AEBUtagRECT@@@Z	3045	0x1400156f0
?ProcessIdProperty@Schema@DirectUI@@2HA	3046	0x140004a2c
?ProcessingKeyboardNavigation@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3047	0x140027ca0
?ProgressBarControlType@Schema@DirectUI@@2HA	3048	0x140015190
?PromptTextProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3049	0x140023620
?PromptWithCaretProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3050	0x140025270
?PropSheet_SendMessage@TaskPage@DirectUI@@IEAA_JI_K_J@Z	3051	0x14003f704
?PropertyChangedCore@Edit@DirectUI@@AEAAXPEBUPropertyInfo@2@HPEAVValue@2@PEAUHWND__@@@Z	3052	0x140001978
?PropertyChangingListener@EventManager@DirectUI@@SAJPEAVElement@2@PEBUPropertyInfo@2@PEA_N@Z	3053	0x1400338e0
?PropertyListener@EventManager@DirectUI@@SAJPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z	3054	0x14002b46c
?PropertyProp@Bind@DirectUI@@SAPEBUPropertyInfo@2@XZ	3055	0x14002ca20
?ProportionalProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3056	0x140037074
?QueryInterface@DuiAccessible@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3057	0x140029a7c
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3058	0x140024c60
?QueryInterface@ElementProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3059	0x14001d0f0
?QueryInterface@ExpandCollapseProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3060	0x1400122c4
?QueryInterface@GridItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3061	0x14001df88
?QueryInterface@GridProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3062	0x14002987c
?QueryInterface@HWNDElementProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3063	0x14000b0e8
?QueryInterface@HWNDHostAccessible@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3064	0x140014660
?QueryInterface@InvokeProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3065	0x140015f90
?QueryInterface@RangeValueProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3066	0x1400099a0
?QueryInterface@ScrollItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3067	0x14002e0b4
?QueryInterface@ScrollProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3068	0x1400115a8
?QueryInterface@SelectionItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3069	0x140038c1c
?QueryInterface@SelectionProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3070	0x140031218
?QueryInterface@TableItemProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3071	0x140036154
?QueryInterface@TableProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3072	0x140022700
?QueryInterface@ToggleProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3073	0x140006e28
?QueryInterface@ValueProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3074	0x140038e5c
?QueryInterface@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z	3075	0x140037e94
?QueryService@DuiAccessible@DirectUI@@UEAAJAEBU_GUID@@0PEAPEAX@Z	3076	0x1400355c8
?QueryService@HWNDHostAccessible@DirectUI@@UEAAJAEBU_GUID@@0PEAPEAX@Z	3077	0x140019934
?QuerySysMetric@DUIXmlParser@DirectUI@@IEAAHHPEA_N@Z	3078	0x14001bf90
?QuerySysMetricStr@DUIXmlParser@DirectUI@@IEAAPEBGHPEAGI@Z	3079	0x14000de20
?QueueDefaultAction@Element@DirectUI@@QEAAJXZ	3080	0x140018858
?RadioButtonControlType@Schema@DirectUI@@2HA	3081	0x140009b5c
?RaiseChildRemovedEvent@EventManager@DirectUI@@CAJAEBUElementRuntimeId@2@PEAVElement@2@@Z	3082	0x140030ce8
?RaiseGeometryEventWorker@EventManager@DirectUI@@CAJPEAURectangleChange@2@_N111@Z	3083	0x140023360
?RaiseGeometryEvents@EventManager@DirectUI@@CAJXZ	3084	0x140029f68
?RaiseStructureChangedEvent@EventManager@DirectUI@@CAJPEAVElement@2@W4StructureChangeType@@@Z	3085	0x140011194
?RaiseStructureEvents@EventManager@DirectUI@@CAJXZ	3086	0x1400114a0
?RaiseVisibilityEvents@EventManager@DirectUI@@CAJXZ	3087	0x14001e538
?RangeMaxProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3088	0x14000a2f0
?RangeMinProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3089	0x14000dd78
?RangeValuePattern@Schema@DirectUI@@2HA	3090	0x140014e48
?RangeValue_IsReadOnly_Property@Schema@DirectUI@@2HA	3091	0x14000d60c
?RangeValue_LargeChange_Property@Schema@DirectUI@@2HA	3092	0x14000bd90
?RangeValue_Maximum_Property@Schema@DirectUI@@2HA	3093	0x140013450
?RangeValue_Minimum_Property@Schema@DirectUI@@2HA	3094	0x14001e9dc
?RangeValue_SmallChange_Property@Schema@DirectUI@@2HA	3095	0x140012820
?RangeValue_Value_Property@Schema@DirectUI@@2HA	3096	0x14000cd14
?RawActionProc@AnimationStrip@DirectUI@@KAXPEAUGMA_ACTIONINFO@@@Z	3097	0x140020740
?RawActionProc@Movie@DirectUI@@SAXPEAUGMA_ACTIONINFO@@@Z	3098	0x140030448
?ReadOnlyProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3099	0x1400387ec
?Recalc@AccessibleButton@DirectUI@@QEAAXXZ	3100	0x140019674
?ReferencePointProp@RefPointElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3101	0x14002e084
?ReflowStyle@PVLAnimation@DirectUI@@SA?AVUID@@XZ	3102	0x14003ce14
?RefreshContent@TouchEdit2@DirectUI@@UEAAJXZ	3103	0x140009cac
?RefreshContent@TouchEditBase@DirectUI@@UEAAJXZ	3104	0x14003d23c
?Register@AccessibleButton@DirectUI@@SAJXZ	3105	0x14003a5bc
?Register@AnimationStrip@DirectUI@@SAJXZ	3106	0x14000ac40
?Register@AutoButton@DirectUI@@SAJXZ	3107	0x14000ccc8
?Register@BaseScrollViewer@DirectUI@@SAJXZ	3108	0x140033a14
?Register@Bind@DirectUI@@SAJXZ	3109	0x1400229b4
?Register@Browser@DirectUI@@SAJXZ	3110	0x140029090
?Register@Button@DirectUI@@SAJXZ	3111	0x140041288
?Register@CCAVI@DirectUI@@SAJXZ	3112	0x140033988
?Register@CCBase@DirectUI@@SAJXZ	3113	0x1400183c0
?Register@CCBaseCheckRadioButton@DirectUI@@SAJXZ	3114	0x140004580
?Register@CCBaseScrollBar@DirectUI@@SAJXZ	3115	0x140024ad0
?Register@CCCheckBox@DirectUI@@SAJXZ	3116	0x140016b54
?Register@CCCommandLink@DirectUI@@SAJXZ	3117	0x140033ce8
?Register@CCHScrollBar@DirectUI@@SAJXZ	3118	0x140030294
?Register@CCListBox@DirectUI@@SAJXZ	3119	0x14003b828
?Register@CCListView@DirectUI@@SAJXZ	3120	0x140018308
?Register@CCProgressBar@DirectUI@@SAJXZ	3121	0x140006b6c
?Register@CCPushButton@DirectUI@@SAJXZ	3122	0x140004868
?Register@CCRadioButton@DirectUI@@SAJXZ	3123	0x14001d1b4
?Register@CCSysLink@DirectUI@@SAJXZ	3124	0x14002e310
?Register@CCTrackBar@DirectUI@@SAJXZ	3125	0x140008b2c
?Register@CCTreeView@DirectUI@@SAJXZ	3126	0x14002cbb8
?Register@CCVScrollBar@DirectUI@@SAJXZ	3127	0x14001bbd4
?Register@CheckBoxGlyph@DirectUI@@SAJXZ	3128	0x140029034
?Register@ClassInfoBase@DirectUI@@QEAAJXZ	3129	0x14003c2ec
?Register@Clipper@DirectUI@@SAJXZ	3130	0x14002f978
?Register@Combobox@DirectUI@@SAJXZ	3131	0x1400130e8
?Register@DialogElement@DirectUI@@SAJXZ	3132	0x140011590
?Register@Edit@DirectUI@@SAJXZ	3133	0x14003864c
?Register@Element@DirectUI@@SAJXZ	3134	0x140031478
?Register@ElementWithHWND@DirectUI@@SAJXZ	3135	0x140039bc0
?Register@Expandable@DirectUI@@SAJXZ	3136	0x14002fa6c
?Register@Expando@DirectUI@@SAJXZ	3137	0x14003f628
?Register@ExpandoButtonGlyph@DirectUI@@SAJXZ	3138	0x14000d2a4
?Register@HWNDElement@DirectUI@@SAJXZ	3139	0x14002eb08
?Register@HWNDHost@DirectUI@@SAJXZ	3140	0x140002848
?Register@ItemList@DirectUI@@SAJXZ	3141	0x14001ea1c
?Register@Macro@DirectUI@@SAJXZ	3142	0x140014234
?Register@ModernProgressBar@DirectUI@@SAJXZ	3143	0x140013500
?Register@ModernProgressRing@DirectUI@@SAJXZ	3144	0x14000c27c
?Register@Movie@DirectUI@@SAJXZ	3145	0x14000e5e4
?Register@Navigator@DirectUI@@SAJXZ	3146	0x14002b204
?Register@PText@DirectUI@@SAJXZ	3147	0x14001b784
?Register@Page@DirectUI@@SAJXZ	3148	0x1400040e4
?Register@Pages@DirectUI@@SAJXZ	3149	0x140032950
?Register@Progress@DirectUI@@SAJXZ	3150	0x14003051c
?Register@PushButton@DirectUI@@SAJXZ	3151	0x14003a3c0
?Register@RadioButtonGlyph@DirectUI@@SAJXZ	3152	0x14003d020
?Register@RefPointElement@DirectUI@@SAJXZ	3153	0x1400039f8
?Register@RepeatButton@DirectUI@@SAJXZ	3154	0x140037d5c
?Register@Repeater@DirectUI@@SAJXZ	3155	0x140018ca0
?Register@RichText@DirectUI@@SAJXZ	3156	0x140006bbc
?Register@ScrollBar@DirectUI@@SAJXZ	3157	0x140027028
?Register@ScrollViewer@DirectUI@@SAJXZ	3158	0x140018e9c
?Register@Selector@DirectUI@@SAJXZ	3159	0x14002eab8
?Register@SelectorNoDefault@DirectUI@@SAJXZ	3160	0x140035cc4
?Register@SemanticZoomToggle@DirectUI@@SAJXZ	3161	0x140027d20
?Register@StyledScrollViewer@DirectUI@@SAJXZ	3162	0x14003f2f4
?Register@TextGraphic@DirectUI@@SAJXZ	3163	0x140034380
?Register@Thumb@DirectUI@@SAJXZ	3164	0x14003541c
?Register@TouchButton@DirectUI@@SAJXZ	3165	0x14002603c
?Register@TouchCheckBox@DirectUI@@SAJXZ	3166	0x14003da44
?Register@TouchCheckBoxGlyph@DirectUI@@SAJXZ	3167	0x1400106c4
?Register@TouchCommandButton@DirectUI@@SAJXZ	3168	0x14003c7ac
?Register@TouchEdit2@DirectUI@@SAJXZ	3169	0x14003c3a8
?Register@TouchEditBase@DirectUI@@SAJXZ	3170	0x14002ad68
?Register@TouchHWNDElement@DirectUI@@SAJXZ	3171	0x140030274
?Register@TouchHyperLink@DirectUI@@SAJXZ	3172	0x14000129c
?Register@TouchRepeatButton@DirectUI@@SAJXZ	3173	0x140013f48
?Register@TouchScrollBar@DirectUI@@SAJXZ	3174	0x14002a2ac
?Register@TouchSelect@DirectUI@@SAJXZ	3175	0x14001cdb4
?Register@TouchSelectItem@DirectUI@@SAJXZ	3176	0x140030778
?Register@TouchSlider@DirectUI@@SAJXZ	3177	0x140020d6c
?Register@TouchSwitch@DirectUI@@SAJXZ	3178	0x14001326c
?Register@UnknownElement@DirectUI@@SAJXZ	3179	0x140010054
?Register@Viewer@DirectUI@@SAJXZ	3180	0x14001e2c8
?Register@XBaby@DirectUI@@SAJXZ	3181	0x14002d4d8
?Register@XElement@DirectUI@@SAJXZ	3182	0x140005fb0
?RegisterForAnimationStatusChanges@TouchHWNDElement@DirectUI@@QEAAXXZ	3183	0x1400038ac
?RegisterForIHMChanges@TouchHWNDElement@DirectUI@@QEAAJXZ	3184	0x14001468c
?RegisterForMonitorPowerChanges@TouchHWNDElement@DirectUI@@QEAAJXZ	3185	0x14000e1cc
?RegisteredDefaultButtonProp@DialogElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3186	0x140016254
?Release@ClassInfoBase@DirectUI@@UEAAHXZ	3187	0x140028180
?Release@DuiAccessible@DirectUI@@UEAAKXZ	3188	0x140038a58
?Release@Element@DirectUI@@QEAAKXZ	3189	0x14001493c
?Release@ElementProvider@DirectUI@@UEAAKXZ	3190	0x14003fe54
?Release@ExpandCollapseProvider@DirectUI@@UEAAKXZ	3191	0x140029c8c
?Release@GridItemProvider@DirectUI@@UEAAKXZ	3192	0x140010a40
?Release@GridProvider@DirectUI@@UEAAKXZ	3193	0x14003d678
?Release@HWNDElementProvider@DirectUI@@UEAAKXZ	3194	0x14003c074
?Release@InvokeProvider@DirectUI@@UEAAKXZ	3195	0x140006acc
?Release@RangeValueProvider@DirectUI@@UEAAKXZ	3196	0x14003488c
?Release@RefcountBase@DirectUI@@QEAAJXZ	3197	0x14002b2d8
?Release@ScrollItemProvider@DirectUI@@UEAAKXZ	3198	0x140014c8c
?Release@ScrollProvider@DirectUI@@UEAAKXZ	3199	0x14000b878
?Release@SelectionItemProvider@DirectUI@@UEAAKXZ	3200	0x140032b50
?Release@SelectionProvider@DirectUI@@UEAAKXZ	3201	0x140007a58
?Release@TableItemProvider@DirectUI@@UEAAKXZ	3202	0x140030af4
?Release@TableProvider@DirectUI@@UEAAKXZ	3203	0x1400359ac
?Release@ToggleProvider@DirectUI@@UEAAKXZ	3204	0x14001487c
?Release@Value@DirectUI@@QEAAXXZ	3205	0x14003918c
?Release@ValueProvider@DirectUI@@UEAAKXZ	3206	0x14003670c
?Release@XProvider@DirectUI@@UEAAKXZ	3207	0x14000f50c
?ReleaseSnapshot@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3208	0x140018ed4
?ReloadIcon@Value@DirectUI@@CAPEAUHICON__@@PEAUGraphic@2@M@Z	3209	0x1400363fc
?Remove@Element@DirectUI@@QEAAJPEAV12@@Z	3210	0x1400308fc
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z	3211	0x14001564c
?Remove@ElementProviderManager@DirectUI@@SAXPEAVElementProvider@2@@Z	3212	0x1400297c8
?Remove@LinkedList@DirectUI@@QEAAXPEAVLinkedListNode@2@@Z	3213	0x140022b48
?RemoveAll@Element@DirectUI@@QEAAJXZ	3214	0x14003e5c8
?RemoveAll@TouchSelect@DirectUI@@QEAAXXZ	3215	0x14002fcd8
?RemoveBehavior@Element@DirectUI@@UEAAJPEAUIDuiBehavior@@@Z	3216	0x14002977c
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ	3217	0x14002747c
?RemoveFromSelection@SelectionItemProvider@DirectUI@@UEAAJXZ	3218	0x140006690
?RemoveItem@TouchSelect@DirectUI@@QEAAJH@Z	3219	0x14001c344
?RemoveListener@Element@DirectUI@@QEAAXPEAUIElementListener@2@@Z	3220	0x14003483c
?RemoveLocalValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZ@Z	3221	0x1400396b8
?RemoveLocalValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@@Z	3222	0x1400279ec
?RemoveRichDuiTooltip@TouchSlider@DirectUI@@QEAAXXZ	3223	0x14002bd6c
?RemoveShortcutFromName@Element@DirectUI@@AEAAPEAGPEBG@Z	3224	0x1400019cc
?RemoveTail@LinkedList@DirectUI@@QEAAPEAVLinkedListNode@2@XZ	3225	0x140001314
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z	3226	0x140004a50
?RemoveTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3227	0x140006df0
?RemoveTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3228	0x140022cf0
?RepeatClick@TouchRepeatButton@DirectUI@@SA?AVUID@@XZ	3229	0x140033d30
?RepeatProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3230	0x140026c28
?Reset@DuiAccessible@DirectUI@@UEAAJXZ	3231	0x140027020
?Reset@HWNDHostAccessible@DirectUI@@UEAAJXZ	3232	0x14000fc90
?ResetInputState@TouchScrollViewer@DirectUI@@QEAAJXZ	3233	0x1400283a8
?ResetManipulations@TouchScrollViewer@DirectUI@@QEAAJXZ	3234	0x140017dd0
?ResolveBindings@Macro@DirectUI@@IEAAXXZ	3235	0x14002e320
?RestoreFocus@NativeHWNDHost@DirectUI@@QEAAHXZ	3236	0x14002a7d8
?Resume@Movie@DirectUI@@QEAAXXZ	3237	0x140034d68
?ReturnValueParser@DUIXmlParser@DirectUI@@IEAAXPEAVValueParser@ParserTools@2@@Z	3238	0x14000d1e8
?Rewind@Movie@DirectUI@@QEAAXXZ	3239	0x1400167d0
?RichTooltipShowing@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3240	0x14000db2c
?RightClick@TouchButton@DirectUI@@SA?AVUID@@XZ	3241	0x14001a2a4
?RuntimeIdProperty@Schema@DirectUI@@2HA	3242	0x14002bb44
?STACKDEPTH@CallstackTracker@DirectUI@@0HB	3243	0x140040808
?SaveFocus@NativeHWNDHost@DirectUI@@QEAAXXZ	3244	0x14001e450
?ScaleChanged@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3245	0x14003f0bc
?ScaleFactorProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3246	0x14001ca4c
?Scroll@BaseScrollBar@DirectUI@@SA?AVUID@@XZ	3247	0x14002e5a8
?Scroll@ScrollProvider@DirectUI@@UEAAJW4ScrollAmount@@0@Z	3248	0x1400210b0
?Scroll@ScrollProxy@DirectUI@@AEAAJW4ScrollAmount@@0@Z	3249	0x140003d80
?ScrollBarControlType@Schema@DirectUI@@2HA	3250	0x14002ffec
?ScrollIntoView@ScrollItemProvider@DirectUI@@UEAAJXZ	3251	0x1400064a8
?ScrollItemPattern@Schema@DirectUI@@2HA	3252	0x14002b56c
?ScrollLine@ScrollProxy@DirectUI@@AEAAJ_N0@Z	3253	0x14001ccd8
?ScrollPaddingProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3254	0x14001cff4
?ScrollPage@ScrollProxy@DirectUI@@AEAAJ_N0@Z	3255	0x14002ec38
?ScrollPattern@Schema@DirectUI@@2HA	3256	0x14002fd30
?ScrollToHorizontalPosition@ScrollProxy@DirectUI@@AEAAJH_N@Z	3257	0x14003648c
?ScrollToVerticalPosition@ScrollProxy@DirectUI@@AEAAJH_N@Z	3258	0x14002c0b0
?Scroll_HorizontalScrollPercent_Property@Schema@DirectUI@@2HA	3259	0x14000c28c
?Scroll_HorizontalViewSize_Property@Schema@DirectUI@@2HA	3260	0x140030964
?Scroll_HorizontallyScrollable_Property@Schema@DirectUI@@2HA	3261	0x140026608
?Scroll_VerticalScrollPercent_Property@Schema@DirectUI@@2HA	3262	0x14003a8f8
?Scroll_VerticalViewSize_Property@Schema@DirectUI@@2HA	3263	0x14000176c
?Scroll_VerticallyScrollable_Property@Schema@DirectUI@@2HA	3264	0x140031ad0
?Select@SelectionItemProvider@DirectUI@@UEAAJXZ	3265	0x140002fe0
?Select@SelectorSelectionItemProxy@DirectUI@@AEAAJXZ	3266	0x140019698
?SelectAll@TouchEdit2@DirectUI@@QEAAJXZ	3267	0x14003a0c8
?SelectNone@TouchEdit2@DirectUI@@QEAAJXZ	3268	0x140023c3c
?SelectedProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3269	0x1400091ac
?SelectionBackgroundColorProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3270	0x14002119c
?SelectionChange@Combobox@DirectUI@@SA?AVUID@@XZ	3271	0x140007748
?SelectionChange@Selector@DirectUI@@SA?AVUID@@XZ	3272	0x140039970
?SelectionChange@TouchSelect@DirectUI@@SA?AVUID@@XZ	3273	0x14003748c
?SelectionForegroundColorProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3274	0x14002fe88
?SelectionInvalidatedEvent@Schema@DirectUI@@2HA	3275	0x14002a778
?SelectionItemElementAddedToSelectionEvent@Schema@DirectUI@@2HA	3276	0x140003100
?SelectionItemElementRemovedFromSelectionEvent@Schema@DirectUI@@2HA	3277	0x14003cd34
?SelectionItemElementSelectedEvent@Schema@DirectUI@@2HA	3278	0x140004f5c
?SelectionItemPattern@Schema@DirectUI@@2HA	3279	0x14001b60c
?SelectionItem_IsSelected_Property@Schema@DirectUI@@2HA	3280	0x140003c18
?SelectionItem_SelectionContainer_Property@Schema@DirectUI@@2HA	3281	0x140037708
?SelectionPattern@Schema@DirectUI@@2HA	3282	0x14002f0fc
?SelectionProp@Combobox@DirectUI@@SAPEBUPropertyInfo@2@XZ	3283	0x14002a1e8
?SelectionProp@Selector@DirectUI@@SAPEBUPropertyInfo@2@XZ	3284	0x14003ee24
?SelectionProp@TouchSelect@DirectUI@@SAPEBUPropertyInfo@2@XZ	3285	0x14000a054
?Selection_CanSelectMultiple_Property@Schema@DirectUI@@2HA	3286	0x14001ba80
?Selection_IsSelectionRequired_Property@Schema@DirectUI@@2HA	3287	0x140039970
?Selection_Selection_Property@Schema@DirectUI@@2HA	3288	0x14001058c
?SemanticChange@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3289	0x140015494
?SemanticZoomControlType@Schema@DirectUI@@2HA	3290	0x140007374
?SendParseError@DUIXmlParser@DirectUI@@IEAAXPEBG0HHJ@Z	3291	0x14000e5f8
?SendParseError@DUIXmlParser@DirectUI@@IEAAXPEBG0PEAUIXmlReader@@J@Z	3292	0x140019e70
?SeparatorControlType@Schema@DirectUI@@2HA	3293	0x14000573c
?SetAbsorbsShortcut@Element@DirectUI@@QEAAJ_N@Z	3294	0x140012170
?SetAccDefAction@Element@DirectUI@@QEAAJPEBG@Z	3295	0x1400048b4
?SetAccDesc@Element@DirectUI@@QEAAJPEBG@Z	3296	0x140004254
?SetAccHelp@Element@DirectUI@@QEAAJPEBG@Z	3297	0x1400258fc
?SetAccItemStatus@Element@DirectUI@@QEAAJPEBG@Z	3298	0x140018090
?SetAccItemType@Element@DirectUI@@QEAAJPEBG@Z	3299	0x14002def4
?SetAccName@Element@DirectUI@@QEAAJPEBG@Z	3300	0x140029568
?SetAccRole@Element@DirectUI@@QEAAJH@Z	3301	0x14002d610
?SetAccState@Element@DirectUI@@QEAAJH@Z	3302	0x14000f328
?SetAccValue@Element@DirectUI@@QEAAJPEBG@Z	3303	0x140038c94
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z	3304	0x14001b71c
?SetActive@Element@DirectUI@@QEAAJH@Z	3305	0x14001e310
?SetActiveState@TouchScrollBar@DirectUI@@QEAAXW4ActiveState@2@_N@Z	3306	0x140016630
?SetActivityOccuring@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3307	0x14003ed18
?SetActivityOccuring@ModernProgressRing@DirectUI@@QEAAJ_N@Z	3308	0x14000fa80
?SetAddLayeredRef@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3309	0x140011110
?SetAddLayeredRef@ModernProgressRing@DirectUI@@QEAAJ_N@Z	3310	0x140021828
?SetAliasedRendering@RichText@DirectUI@@QEAAJ_N@Z	3311	0x1400180d8
?SetAllowArrowOut@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3312	0x14000cbc0
?SetAlpha@Element@DirectUI@@QEAAJH@Z	3313	0x1400348d0
?SetAnimatePopupOnDismiss@TouchSelect@DirectUI@@QEAAJ_N@Z	3314	0x14001aedc
?SetAnimation@Element@DirectUI@@QEAAJH@Z	3315	0x140014c54
?SetAutoGrouping@CCRadioButton@DirectUI@@QEAAJ_N@Z	3316	0x1400235c8
?SetAutoHeight@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3317	0x14001de6c
?SetAutoStart@Movie@DirectUI@@QEAAJ_N@Z	3318	0x14001a3f0
?SetAutoStop@Movie@DirectUI@@QEAAJ_N@Z	3319	0x14001a728
?SetBackgroundColor@Element@DirectUI@@QEAAJAEBUFill@2@@Z	3320	0x14001e568
?SetBackgroundColor@Element@DirectUI@@QEAAJK@Z	3321	0x140033dc8
?SetBackgroundColor@Element@DirectUI@@QEAAJKKE@Z	3322	0x14002f028
?SetBackgroundColor@Element@DirectUI@@QEAAJKKKE@Z	3323	0x140039bd4
?SetBackgroundColor@Element@DirectUI@@QEAAJPEBGHH@Z	3324	0x140004da0
?SetBackgroundOwnerID@HWNDHost@DirectUI@@QEAAJPEBG@Z	3325	0x1400050ec
?SetBackgroundStdColor@Element@DirectUI@@QEAAJH@Z	3326	0x1400167e8
?SetBaseline@RichText@DirectUI@@QEAAJH@Z	3327	0x140002f58
?SetBorderColor@Element@DirectUI@@QEAAJK@Z	3328	0x14000e780
?SetBorderGradientColor@Element@DirectUI@@QEAAJKKE@Z	3329	0x140007ac0
?SetBorderStdColor@Element@DirectUI@@QEAAJH@Z	3330	0x1400035a0
?SetBorderStyle@Element@DirectUI@@QEAAJH@Z	3331	0x14000cb80
?SetBorderThickness@Element@DirectUI@@QEAAJHHHH@Z	3332	0x1400069fc
?SetBuffering@TouchSlider@DirectUI@@QEAAJH@Z	3333	0x14002a860
?SetButtonClassAcceptsEnterKey@DialogElement@DirectUI@@QEAAJ_N@Z	3334	0x140032df0
?SetButtonClassAcceptsEnterKey@XBaby@DirectUI@@UEAAJ_N@Z	3335	0x1400222c8
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UEAAJ_N@Z	3336	0x14001f3f0
?SetCache@RichText@DirectUI@@QEAAXKPEAUIDUIRichTextCache@@@Z	3337	0x14004151c
?SetCacheDirty@Layout@DirectUI@@IEAAXXZ	3338	0x140007508
?SetCaptured@Button@DirectUI@@QEAAJ_N@Z	3339	0x140006af8
?SetCaptured@TouchButton@DirectUI@@QEAAJ_N@Z	3340	0x140028278
?SetCaretPosition@TouchEdit2@DirectUI@@QEAAJJ@Z	3341	0x140011eb0
?SetCheckedState@TouchCheckBox@DirectUI@@QEAAJW4CheckedStateFlags@2@@Z	3342	0x1400282e0
?SetClass@Element@DirectUI@@QEAAJPEBG@Z	3343	0x14000d70c
?SetClassInfoPtr@AccessibleButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3344	0x14001d9e0
?SetClassInfoPtr@AnimationStrip@DirectUI@@SAXPEAUIClassInfo@2@@Z	3345	0x140019ba0
?SetClassInfoPtr@AutoButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3346	0x14000bb5c
?SetClassInfoPtr@BaseScrollViewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3347	0x14003613c
?SetClassInfoPtr@Bind@DirectUI@@SAXPEAUIClassInfo@2@@Z	3348	0x14000c1c4
?SetClassInfoPtr@Browser@DirectUI@@SAXPEAUIClassInfo@2@@Z	3349	0x14000f100
?SetClassInfoPtr@Button@DirectUI@@SAXPEAUIClassInfo@2@@Z	3350	0x14002e3b0
?SetClassInfoPtr@CCAVI@DirectUI@@SAXPEAUIClassInfo@2@@Z	3351	0x140037358
?SetClassInfoPtr@CCBase@DirectUI@@SAXPEAUIClassInfo@2@@Z	3352	0x14003cba0
?SetClassInfoPtr@CCBaseCheckRadioButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3353	0x14002d078
?SetClassInfoPtr@CCBaseScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3354	0x1400397e8
?SetClassInfoPtr@CCCheckBox@DirectUI@@SAXPEAUIClassInfo@2@@Z	3355	0x140022eb4
?SetClassInfoPtr@CCCommandLink@DirectUI@@SAXPEAUIClassInfo@2@@Z	3356	0x140009c6c
?SetClassInfoPtr@CCHScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3357	0x1400086b8
?SetClassInfoPtr@CCListBox@DirectUI@@SAXPEAUIClassInfo@2@@Z	3358	0x140004360
?SetClassInfoPtr@CCListView@DirectUI@@SAXPEAUIClassInfo@2@@Z	3359	0x140016a7c
?SetClassInfoPtr@CCProgressBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3360	0x140034490
?SetClassInfoPtr@CCPushButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3361	0x14003a768
?SetClassInfoPtr@CCRadioButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3362	0x14003af14
?SetClassInfoPtr@CCSysLink@DirectUI@@SAXPEAUIClassInfo@2@@Z	3363	0x140026c74
?SetClassInfoPtr@CCTrackBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3364	0x14000ae4c
?SetClassInfoPtr@CCTreeView@DirectUI@@SAXPEAUIClassInfo@2@@Z	3365	0x14001164c
?SetClassInfoPtr@CCVScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3366	0x1400208b4
?SetClassInfoPtr@CheckBoxGlyph@DirectUI@@SAXPEAUIClassInfo@2@@Z	3367	0x140028048
?SetClassInfoPtr@Clipper@DirectUI@@SAXPEAUIClassInfo@2@@Z	3368	0x140028308
?SetClassInfoPtr@Combobox@DirectUI@@SAXPEAUIClassInfo@2@@Z	3369	0x1400293e8
?SetClassInfoPtr@DialogElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3370	0x14002982c
?SetClassInfoPtr@Edit@DirectUI@@SAXPEAUIClassInfo@2@@Z	3371	0x14002cd5c
?SetClassInfoPtr@Element@DirectUI@@SAXPEAUIClassInfo@2@@Z	3372	0x140017f98
?SetClassInfoPtr@ElementWithHWND@DirectUI@@SAXPEAUIClassInfo@2@@Z	3373	0x1400268f8
?SetClassInfoPtr@Expandable@DirectUI@@SAXPEAUIClassInfo@2@@Z	3374	0x1400073e4
?SetClassInfoPtr@Expando@DirectUI@@SAXPEAUIClassInfo@2@@Z	3375	0x1400407e4
?SetClassInfoPtr@ExpandoButtonGlyph@DirectUI@@SAXPEAUIClassInfo@2@@Z	3376	0x14000a544
?SetClassInfoPtr@HWNDElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3377	0x14000ee58
?SetClassInfoPtr@HWNDHost@DirectUI@@SAXPEAUIClassInfo@2@@Z	3378	0x14000a70c
?SetClassInfoPtr@Macro@DirectUI@@SAXPEAUIClassInfo@2@@Z	3379	0x14000aeb0
?SetClassInfoPtr@Movie@DirectUI@@SAXPEAUIClassInfo@2@@Z	3380	0x1400409a8
?SetClassInfoPtr@Navigator@DirectUI@@SAXPEAUIClassInfo@2@@Z	3381	0x14001d488
?SetClassInfoPtr@PText@DirectUI@@SAXPEAUIClassInfo@2@@Z	3382	0x140025af0
?SetClassInfoPtr@Page@DirectUI@@SAXPEAUIClassInfo@2@@Z	3383	0x14002bd74
?SetClassInfoPtr@Pages@DirectUI@@SAXPEAUIClassInfo@2@@Z	3384	0x14001bd64
?SetClassInfoPtr@Progress@DirectUI@@SAXPEAUIClassInfo@2@@Z	3385	0x140007158
?SetClassInfoPtr@PushButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3386	0x14001ca10
?SetClassInfoPtr@RadioButtonGlyph@DirectUI@@SAXPEAUIClassInfo@2@@Z	3387	0x14001a090
?SetClassInfoPtr@RefPointElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3388	0x140034190
?SetClassInfoPtr@RepeatButton@DirectUI@@SAXPEAUIClassInfo@2@@Z	3389	0x140009638
?SetClassInfoPtr@Repeater@DirectUI@@SAXPEAUIClassInfo@2@@Z	3390	0x140029300
?SetClassInfoPtr@ScrollBar@DirectUI@@SAXPEAUIClassInfo@2@@Z	3391	0x1400391ac
?SetClassInfoPtr@ScrollViewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3392	0x1400165a8
?SetClassInfoPtr@Selector@DirectUI@@SAXPEAUIClassInfo@2@@Z	3393	0x1400155e4
?SetClassInfoPtr@SelectorNoDefault@DirectUI@@SAXPEAUIClassInfo@2@@Z	3394	0x140020194
?SetClassInfoPtr@StyledScrollViewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3395	0x14002ede0
?SetClassInfoPtr@TextGraphic@DirectUI@@SAXPEAUIClassInfo@2@@Z	3396	0x14001d958
?SetClassInfoPtr@Thumb@DirectUI@@SAXPEAUIClassInfo@2@@Z	3397	0x1400109a0
?SetClassInfoPtr@UnknownElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3398	0x140018680
?SetClassInfoPtr@Viewer@DirectUI@@SAXPEAUIClassInfo@2@@Z	3399	0x140038c30
?SetClassInfoPtr@XBaby@DirectUI@@SAXPEAUIClassInfo@2@@Z	3400	0x140003d20
?SetClassInfoPtr@XElement@DirectUI@@SAXPEAUIClassInfo@2@@Z	3401	0x140030514
?SetClient@BorderLayout@DirectUI@@AEAAXPEAVElement@2@@Z	3402	0x14001bb9c
?SetColorFontPaletteIndex@RichText@DirectUI@@QEAAJH@Z	3403	0x140004998
?SetCompositedText@Element@DirectUI@@QEAAJ_N@Z	3404	0x14003c77c
?SetCompositingQuality@Movie@DirectUI@@QEAAJH@Z	3405	0x14001a46c
?SetConnect@Bind@DirectUI@@QEAAJPEBG@Z	3406	0x14000ebcc
?SetConstrainLayout@RichText@DirectUI@@QEAAJH@Z	3407	0x140010bd4
?SetContact@TouchScrollViewer@DirectUI@@QEAAJI_N@Z	3408	0x140013824
?SetContactNeeded@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3409	0x14001c29c
?SetContactNotify@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3410	0x140029578
?SetContentAlign@Element@DirectUI@@QEAAJH@Z	3411	0x14003b6c8
?SetContentGraphic@Element@DirectUI@@QEAAJPEBGEI@Z	3412	0x1400354a4
?SetContentGraphic@Element@DirectUI@@QEAAJPEBGGG@Z	3413	0x140011544
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z	3414	0x14003081c
?SetCursor@Element@DirectUI@@QEAAJPEBG@Z	3415	0x140035540
?SetCursorHandle@Element@DirectUI@@QEAAJPEAUHICON__@@@Z	3416	0x14000792c
?SetDWriteFontCollection@RichText@DirectUI@@QEAAXPEAUIDWriteFontCollection@@@Z	3417	0x140001028
?SetDWriteTextLayout@RichText@DirectUI@@QEAAXPEAUIDWriteTextLayout@@@Z	3418	0x140024a94
?SetDataEngine@Repeater@DirectUI@@QEAAXPEAUIDataEngine@2@@Z	3419	0x1400095b8
?SetDataEntry@Macro@DirectUI@@QEAAXPEAUIDataEntry@2@PEAVElement@2@@Z	3420	0x1400210b8
?SetDataEntry@PText@DirectUI@@QEAAXPEAUIDataEntry@2@@Z	3421	0x1400216e8
?SetDefaultButtonTracking@DialogElement@DirectUI@@UEAAJ_N@Z	3422	0x140006afc
?SetDefaultButtonTracking@XBaby@DirectUI@@UEAAJ_N@Z	3423	0x140031098
?SetDefaultButtonTracking@XProvider@DirectUI@@UEAAJ_N@Z	3424	0x14000ee54
?SetDefaultFocusID@NativeHWNDHost@DirectUI@@QEAAXPEBG@Z	3425	0x14000c464
?SetDefaultGraphicType@Macro@DirectUI@@QEAAXE_N@Z	3426	0x1400081d8
?SetDefaultHInstance@DUIXmlParser@DirectUI@@QEAAXPEAUHINSTANCE__@@@Z	3427	0x14003ec4c
?SetDefaultState@CCPushButton@DirectUI@@IEAAXKK@Z	3428	0x140037bb4
?SetDelegateEventHandler@TouchScrollViewer@DirectUI@@QEAAJPEAUIUnknown@@@Z	3429	0x14002d36c
?SetDeterminate@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3430	0x1400120fc
?SetDirection@Element@DirectUI@@QEAAJH@Z	3431	0x140018504
?SetDirty@Edit@DirectUI@@QEAAJ_N@Z	3432	0x14003ca7c
?SetDisableAccTextExtend@RichText@DirectUI@@QEAAJ_N@Z	3433	0x140032a2c
?SetDisableMouseInRectCheck@TouchRepeatButton@DirectUI@@QEAAJ_N@Z	3434	0x140041640
?SetDisableOffscreenCaching@TouchScrollViewer@DirectUI@@QEAAX_N@Z	3435	0x140031410
?SetDrawOutlines@Movie@DirectUI@@QEAAJ_N@Z	3436	0x140004110
?SetDynamicScaling@DUIXmlParser@DirectUI@@QEAAXW4DynamicScaleParsing@2@@Z	3437	0x14000d974
?SetEdgeHighlightColor@Element@DirectUI@@QEAAJK@Z	3438	0x14003aa54
?SetEdgeHighlightThickness@Element@DirectUI@@QEAAJHHHH@Z	3439	0x140026098
?SetElementMovesOnIHMNotify@TouchEditBase@DirectUI@@QEAAJ_N@Z	3440	0x140003958
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z	3441	0x14002710c
?SetEncodedContentString@Element@DirectUI@@QEAAJPEBG@Z	3442	0x140024b14
?SetEnforceSize@PushButton@DirectUI@@QEAAJ_N@Z	3443	0x14003c164
?SetEnsureVisibleUseLayoutCoordinates@Viewer@DirectUI@@QEAAX_N@Z	3444	0x14001d19c
?SetError@DUIFactory@DirectUI@@QEAAXPEBGZZ	3445	0x14000134c
?SetExpand@Macro@DirectUI@@QEAAJPEBG@Z	3446	0x140029e94
?SetExpanded@Expandable@DirectUI@@QEAAJ_N@Z	3447	0x14000ed00
?SetFilterOnPaste@TouchEditBase@DirectUI@@QEAAJ_N@Z	3448	0x1400183d8
?SetFireContinuousSliderEvent@TouchSlider@DirectUI@@QEAAX_N@Z	3449	0x140014ee8
?SetFlags@TouchHWNDElement@DirectUI@@QEAAJW4TouchHWNDElementFlags@2@0@Z	3450	0x1400040c8
?SetFocus@ElementProvider@DirectUI@@UEAAJXZ	3451	0x140030088
?SetFocus@HWNDElement@DirectUI@@QEAAX_N@Z	3452	0x140001d44
?SetFocus@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z	3453	0x140015fb4
?SetFont@Element@DirectUI@@QEAAJPEBG@Z	3454	0x14002f058
?SetFontColorRuns@RichText@DirectUI@@QEAAJPEBG@Z	3455	0x14000ac5c
?SetFontFace@Element@DirectUI@@QEAAJPEBG@Z	3456	0x140041700
?SetFontQuality@Element@DirectUI@@QEAAJH@Z	3457	0x140026370
?SetFontSize@Element@DirectUI@@QEAAJH@Z	3458	0x14002466c
?SetFontSizeRuns@RichText@DirectUI@@QEAAJPEBG@Z	3459	0x14000c8dc
?SetFontStyle@Element@DirectUI@@QEAAJH@Z	3460	0x140011a54
?SetFontWeight@Element@DirectUI@@QEAAJH@Z	3461	0x1400319bc
?SetFontWeightRuns@RichText@DirectUI@@QEAAJPEBG@Z	3462	0x140008dd0
?SetForceEditTextToLTR@TouchEditBase@DirectUI@@QEAAJ_N@Z	3463	0x140014f18
?SetForegroundColor@Element@DirectUI@@QEAAJK@Z	3464	0x140009a10
?SetForegroundColor@Element@DirectUI@@QEAAJKKE@Z	3465	0x140035a3c
?SetForegroundColor@Element@DirectUI@@QEAAJKKKE@Z	3466	0x1400361ac
?SetForegroundStdColor@Element@DirectUI@@QEAAJH@Z	3467	0x14001a8dc
?SetFrameDuration@AnimationStrip@DirectUI@@QEAAJH@Z	3468	0x140009c84
?SetFrameIndex@AnimationStrip@DirectUI@@QEAAJH@Z	3469	0x140011c4c
?SetFrameWidth@AnimationStrip@DirectUI@@QEAAJH@Z	3470	0x140008db8
?SetGetSheetCallback@DUIXmlParser@DirectUI@@QEAAXP6APEAVValue@2@PEBGPEAX@Z1@Z	3471	0x140027f38
?SetGraphicType@Repeater@DirectUI@@QEAAXE@Z	3472	0x14003b708
?SetHandleEnter@TouchButton@DirectUI@@QEAAJ_N@Z	3473	0x14002958c
?SetHandleEnterKey@DialogElement@DirectUI@@QEAAJ_N@Z	3474	0x140038444
?SetHandleEnterKey@XBaby@DirectUI@@UEAAJ_N@Z	3475	0x14001f21c
?SetHandleEnterKey@XProvider@DirectUI@@IEAAX_N@Z	3476	0x14003fc08
?SetHandleGlobalEnter@TouchButton@DirectUI@@QEAAJ_N@Z	3477	0x14003687c
?SetHeight@Element@DirectUI@@QEAAJH@Z	3478	0x140032a00
?SetID@Element@DirectUI@@QEAAJPEBG@Z	3479	0x140005864
?SetIMEComposing@TouchEditBase@DirectUI@@QEAAJ_N@Z	3480	0x14001e760
?SetIgnoredKeyCombos@TouchEditBase@DirectUI@@QEAAJW4TouchEditFilteredKeyComboFlags@2@0@Z	3481	0x140015660
?SetIndependentAnimations@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3482	0x14000f0f4
?SetInnerBorderThickness@TouchEdit2@DirectUI@@QEAAJHHHH@Z	3483	0x14001e6f0
?SetInputScope@TouchEdit2@DirectUI@@QEAAJW4__MIDL___MIDL_itf_inputscope_0000_0000_0001@@@Z	3484	0x14001d938
?SetIntegrateIMECandidateList@TouchEditBase@DirectUI@@QEAAJ_N@Z	3485	0x140036128
?SetInteractionMode@TouchScrollViewer@DirectUI@@QEAAJH@Z	3486	0x140023bc4
?SetInterpolationMode@Movie@DirectUI@@QEAAJH@Z	3487	0x14002ba38
?SetIsContinuous@TouchSlider@DirectUI@@QEAAJ_N@Z	3488	0x1400307b4
?SetIsPressed@TouchSlider@DirectUI@@QEAAJ_N@Z	3489	0x140021c98
?SetIsShowOnOffFeedback@TouchSlider@DirectUI@@QEAAJ_N@Z	3490	0x1400209b8
?SetIsVertical@TouchSlider@DirectUI@@QEAAJ_N@Z	3491	0x140032b80
?SetItemData@TouchSelect@DirectUI@@QEAAJHPEAUIUnknown@@@Z	3492	0x14003a048
?SetItemData@TouchSelectItem@DirectUI@@QEAAJPEAUIUnknown@@@Z	3493	0x140040d38
?SetItemHeightInPopup@TouchSelect@DirectUI@@QEAAJH@Z	3494	0x140027218
?SetItemState@CCTreeView@DirectUI@@QEAAXPEAU_TREEITEM@@I@Z	3495	0x14002ea1c
?SetKeyFocus@Element@DirectUI@@UEAAXXZ	3496	0x140018a44
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ	3497	0x14003aaf0
?SetKeyFocus@TouchEditBase@DirectUI@@UEAAXXZ	3498	0x1400215fc
?SetKeyFocus@XBaby@DirectUI@@UEAAXXZ	3499	0x1400364e0
?SetKeyFocus@XElement@DirectUI@@UEAAXXZ	3500	0x140002430
?SetKeyboardNavigationCapture@TouchEditBase@DirectUI@@QEAAJW4TouchEditKeyboardNavigationCapture@2@@Z	3501	0x140035cbc
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z	3502	0x14001a5c8
?SetLayoutCompletionNotify@Element@DirectUI@@QEAAX_N@Z	3503	0x140028738
?SetLayoutPointerToNull@Value@DirectUI@@QEAAXXZ	3504	0x140033e94
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z	3505	0x140038bb0
?SetLightDismissIHM@TouchHWNDElement@DirectUI@@QEAAJ_N@Z	3506	0x14003b360
?SetLine@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3507	0x140037058
?SetLine@ScrollBar@DirectUI@@UEAAJH@Z	3508	0x14003889c
?SetLineSize@CCTrackBar@DirectUI@@QEAAJH@Z	3509	0x140040f54
?SetLineSpacing@RichText@DirectUI@@QEAAJH@Z	3510	0x1400360a0
?SetLinkIndicatorsToContent@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3511	0x140020408
?SetLocale@RichText@DirectUI@@QEAAJPEBG@Z	3512	0x14001f5d0
?SetManipulationHorizontalAlignment@TouchScrollViewer@DirectUI@@QEAAJH@Z	3513	0x1400236f4
?SetManipulationVerticalAlignment@TouchScrollViewer@DirectUI@@QEAAJH@Z	3514	0x1400140a8
?SetMapRunsToClusters@RichText@DirectUI@@QEAAJ_N@Z	3515	0x140024858
?SetMargin@Element@DirectUI@@QEAAJHHHH@Z	3516	0x14000a1a0
?SetMaxLength@Edit@DirectUI@@QEAAJH@Z	3517	0x140035500
?SetMaxLength@TouchEditBase@DirectUI@@QEAAJH@Z	3518	0x140020d80
?SetMaxLineCount@RichText@DirectUI@@QEAAXI@Z	3519	0x1400406d4
?SetMaximum@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3520	0x140038fa8
?SetMaximum@ModernProgressBar@DirectUI@@QEAAJH@Z	3521	0x14002fa20
?SetMaximum@Progress@DirectUI@@QEAAJH@Z	3522	0x140011570
?SetMaximum@ScrollBar@DirectUI@@UEAAJH@Z	3523	0x14002cfec
?SetMetering@TouchSlider@DirectUI@@QEAAJH@Z	3524	0x1400328c0
?SetMinSize@Element@DirectUI@@QEAAJHH@Z	3525	0x140034d64
?SetMinimum@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3526	0x140040bc0
?SetMinimum@ModernProgressBar@DirectUI@@QEAAJH@Z	3527	0x140034e10
?SetMinimum@Progress@DirectUI@@QEAAJH@Z	3528	0x140021f34
?SetMinimum@ScrollBar@DirectUI@@UEAAJH@Z	3529	0x140009f20
?SetMoveCaretToEndOnSyncContent@TouchEditBase@DirectUI@@QEAAJ_N@Z	3530	0x140001140
?SetMultiline@Edit@DirectUI@@QEAAJ_N@Z	3531	0x14000913c
?SetMultiline@TouchEditBase@DirectUI@@QEAAJ_N@Z	3532	0x14001486c
?SetNoBrowseOnFirstAdd@Pages@DirectUI@@QEAAXXZ	3533	0x14000ec48
?SetNote@CCCommandLink@DirectUI@@QEAAJPEBG@Z	3534	0x14003fcb0
?SetNotifyHandler@CCBase@DirectUI@@QEAAXP6AHI_K_JPEA_JPEAX@Z3@Z	3535	0x14001cc0c
?SetOffText@TouchSwitch@DirectUI@@QEAAJPEBG@Z	3536	0x140031134
?SetOnOffText@TouchSwitch@DirectUI@@QEAAXPEBG0@Z	3537	0x14002fb3c
?SetOnText@TouchSwitch@DirectUI@@QEAAJPEBG@Z	3538	0x14002247c
?SetOptimizeMove@HWNDHost@DirectUI@@QEAAJ_N@Z	3539	0x140036fa0
?SetOrder@ScrollBar@DirectUI@@QEAAJH@Z	3540	0x14001a9ec
?SetOverhang@Element@DirectUI@@QEAAJ_N@Z	3541	0x14003c634
?SetOverhangOffset@RichText@DirectUI@@QEAAJH@Z	3542	0x14002fd30
?SetOverrideButtonBackground@CCPushButton@DirectUI@@QEAAJ_N@Z	3543	0x140037244
?SetOverrideScaleFactor@DUIXmlParser@DirectUI@@QEAAXM@Z	3544	0x14002db0c
?SetOverrideScaleFactor@Element@DirectUI@@QEAAXM@Z	3545	0x140019638
?SetPVLAnimationState@Element@DirectUI@@QEAAXH@Z	3546	0x140015d9c
?SetPadding@Element@DirectUI@@QEAAJHHHH@Z	3547	0x140037f30
?SetPage@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3548	0x140023274
?SetPage@ScrollBar@DirectUI@@UEAAJH@Z	3549	0x14001c698
?SetParameter@XProvider@DirectUI@@UEAAJAEBU_GUID@@PEAX@Z	3550	0x140037200
?SetParentSizeControl@HWNDElement@DirectUI@@QEAAX_N@Z	3551	0x1400116f8
?SetParseErrorCallback@DUIXmlParser@DirectUI@@QEAAXP6AXPEBG0HPEAX@Z1@Z	3552	0x140037454
?SetParseState@DUIXmlParser@DirectUI@@AEAAXW4_DUI_PARSE_STATE@2@@Z	3553	0x14000d14c
?SetParser@Macro@DirectUI@@QEAAXPEAVDUIXmlParser@2@@Z	3554	0x1400157c0
?SetPasswordCharacter@Edit@DirectUI@@QEAAJH@Z	3555	0x14002fd88
?SetPasswordCharacter@TouchEditBase@DirectUI@@QEAAJH@Z	3556	0x14002c3f4
?SetPasswordRevealMode@TouchEdit2@DirectUI@@QEAAJW4TouchEditPasswordRevealMode@2@@Z	3557	0x14003d80c
?SetPath@Movie@DirectUI@@QEAAJPEBG@Z	3558	0x14002f2fc
?SetPercent@ScrollProxy@DirectUI@@AEAAJPEAVBaseScrollBar@2@N@Z	3559	0x1400385f8
?SetPinned@BaseScrollBar@DirectUI@@QEAAX_N@Z	3560	0x14002c50c
?SetPinning@BaseScrollViewer@DirectUI@@QEAAJH@Z	3561	0x14001e494
?SetPixelOffsetMode@Movie@DirectUI@@QEAAJH@Z	3562	0x1400344c4
?SetPlay@AnimationStrip@DirectUI@@QEAAJ_N@Z	3563	0x1400415ac
?SetPlayAllFramesMode@Movie@DirectUI@@QEAAJ_N@Z	3564	0x140025170
?SetPopupBounds@TouchSelect@DirectUI@@QEAAJHHHH@Z	3565	0x1400042d8
?SetPosition@CCBaseScrollBar@DirectUI@@UEAAJH@Z	3566	0x14001b564
?SetPosition@ModernProgressBar@DirectUI@@QEAAJH@Z	3567	0x1400030cc
?SetPosition@Progress@DirectUI@@QEAAJH@Z	3568	0x14003f0e8
?SetPosition@ScrollBar@DirectUI@@UEAAJH@Z	3569	0x140003b94
?SetPreprocessedXML@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z	3570	0x140040a50
?SetPreserveAlphaChannel@Element@DirectUI@@QEAAX_N@Z	3571	0x140016ebc
?SetPressed@Button@DirectUI@@QEAAJ_N@Z	3572	0x1400060ac
?SetPressed@TouchButton@DirectUI@@QEAAJ_N@Z	3573	0x14003e600
?SetPreventFormatChangeUpdatingModifiedState@TouchEditBase@DirectUI@@QEAAJ_N@Z	3574	0x14003a5dc
?SetPromptText@TouchEdit2@DirectUI@@QEAAJPEBG@Z	3575	0x140011424
?SetPromptWithCaret@TouchEdit2@DirectUI@@QEAAJ_N@Z	3576	0x14003fb98
?SetProperty@Bind@DirectUI@@QEAAJPEBG@Z	3577	0x140033c80
?SetProportional@ScrollBar@DirectUI@@QEAAJ_N@Z	3578	0x1400390dc
?SetProvider@XElement@DirectUI@@QEAAJPEAUIUnknown@@@Z	3579	0x140029a4c
?SetRangeMax@CCTrackBar@DirectUI@@QEAAJH@Z	3580	0x14003e76c
?SetRangeMax@TouchSlider@DirectUI@@QEAAXH@Z	3581	0x140037010
?SetRangeMin@CCTrackBar@DirectUI@@QEAAJH@Z	3582	0x14003aeb8
?SetRangeMin@TouchSlider@DirectUI@@QEAAXH@Z	3583	0x1400136b4
?SetRangeMinAndRangeMax@TouchSlider@DirectUI@@QEAAXHH@Z	3584	0x140012544
?SetReadOnly@TouchEditBase@DirectUI@@QEAAJ_N@Z	3585	0x140027f9c
?SetReferencePoint@RefPointElement@DirectUI@@QEAAJHH@Z	3586	0x14001a5a0
?SetRegisteredDefaultButton@DialogElement@DirectUI@@QEAAJPEAVElement@2@@Z	3587	0x140036a98
?SetRegisteredDefaultButton@XBaby@DirectUI@@UEAAJPEAVElement@2@@Z	3588	0x140007250
?SetRegisteredDefaultButton@XProvider@DirectUI@@UEAAJPEAVElement@2@@Z	3589	0x140018cf4
?SetRegisteredDefaultButtonSelectedState@DialogElementCore@DirectUI@@IEAAX_N@Z	3590	0x14000f5d8
?SetRelPixHeight@Element@DirectUI@@QEAAJH@Z	3591	0x14001ccb0
?SetRelPixMargin@Element@DirectUI@@QEAAJHHHH@Z	3592	0x14003e140
?SetRelPixPadding@Element@DirectUI@@QEAAJHHHH@Z	3593	0x14003befc
?SetRelPixWidth@Element@DirectUI@@QEAAJH@Z	3594	0x1400300f0
?SetReorderable@ItemList@DirectUI@@QEAAJ_N@Z	3595	0x14000f044
?SetRepeat@Movie@DirectUI@@QEAAJ_N@Z	3596	0x14001e730
?SetRespectLanguageDirection@TouchSlider@DirectUI@@QEAAX_N@Z	3597	0x140031070
?SetRespondToMouseScroll@TouchSlider@DirectUI@@QEAAX_N@Z	3598	0x140035d9c
?SetScaleFactor@DUIXmlParser@DirectUI@@QEAAXM@Z	3599	0x140003690
?SetScreenCenter@HWNDElement@DirectUI@@QEAAX_N@Z	3600	0x140005a58
?SetScrollControlHost@TouchScrollViewer@DirectUI@@QEAAJPEAVElement@2@@Z	3601	0x140035164
?SetScrollPadding@TouchScrollViewer@DirectUI@@QEAAJHHHH@Z	3602	0x14002e73c
?SetScrollPercent@ScrollProvider@DirectUI@@UEAAJNN@Z	3603	0x140029c88
?SetScrollPercent@ScrollProxy@DirectUI@@AEAAJNN@Z	3604	0x1400135c8
?SetSelected@Element@DirectUI@@QEAAJ_N@Z	3605	0x14000cea4
?SetSelection@Combobox@DirectUI@@QEAAJH@Z	3606	0x140023a58
?SetSelection@Selector@DirectUI@@UEAAJPEAVElement@2@@Z	3607	0x140012304
?SetSelection@SelectorNoDefault@DirectUI@@UEAAJPEAVElement@2@@Z	3608	0x140037b48
?SetSelection@TouchEdit2@DirectUI@@QEAAJJJ@Z	3609	0x140021238
?SetSelection@TouchSelect@DirectUI@@QEAAJPEAVElement@2@@Z	3610	0x140011834
?SetSelectionBackgroundColor@TouchEditBase@DirectUI@@QEAAJPEAVValue@2@@Z	3611	0x14002975c
?SetSelectionForegroundColor@TouchEditBase@DirectUI@@QEAAJPEAVValue@2@@Z	3612	0x14000b4ec
?SetSelectionIndex@TouchSelect@DirectUI@@QEAAJH@Z	3613	0x140003710
?SetShadowIntensity@Element@DirectUI@@QEAAJH@Z	3614	0x1400046ac
?SetSheet@Element@DirectUI@@QEAAJPEAVStyleSheet@2@@Z	3615	0x14000274c
?SetShortcut@Element@DirectUI@@QEAAJH@Z	3616	0x14001d38c
?SetShowClearButtonMinWidth@TouchEdit2@DirectUI@@QEAAJH@Z	3617	0x14002f2ec
?SetShowKeyFocus@TouchButton@DirectUI@@QEAAJ_N@Z	3618	0x140033a14
?SetShowTick@TouchSlider@DirectUI@@QEAAJ_N@Z	3619	0x14000d6f0
?SetSmoothFillAnimation@ModernProgressBar@DirectUI@@QEAAJ_N@Z	3620	0x140003b28
?SetSmoothingMode@Movie@DirectUI@@QEAAJH@Z	3621	0x140001750
?SetSnapIntervalX@TouchScrollViewer@DirectUI@@QEAAJM@Z	3622	0x14003df94
?SetSnapIntervalY@TouchScrollViewer@DirectUI@@QEAAJM@Z	3623	0x14002e610
?SetSnapMode@TouchScrollViewer@DirectUI@@QEAAJH@Z	3624	0x140036734
?SetSnapOffsetX@TouchScrollViewer@DirectUI@@QEAAJM@Z	3625	0x14002ca30
?SetSnapOffsetY@TouchScrollViewer@DirectUI@@QEAAJM@Z	3626	0x14002aac0
?SetSnapPointCollectionX@TouchScrollViewer@DirectUI@@QEAAJPEAV?$DynamicArray@N$0A@@2@@Z	3627	0x14001532c
?SetSnapPointCollectionX@TouchScrollViewer@DirectUI@@QEAAJPEBNH@Z	3628	0x14002cb9c
?SetSnapPointCollectionY@TouchScrollViewer@DirectUI@@QEAAJPEAV?$DynamicArray@N$0A@@2@@Z	3629	0x140035fa8
?SetSnapPointCollectionY@TouchScrollViewer@DirectUI@@QEAAJPEBNH@Z	3630	0x140005cf4
?SetState@ModernProgressBar@DirectUI@@QEAAJH@Z	3631	0x14000cdcc
?SetStdCursor@Element@DirectUI@@QEAAJH@Z	3632	0x140001864
?SetStepCount@TouchSlider@DirectUI@@QEAAXH@Z	3633	0x1400067b8
?SetStopThumbBehavior@RepeatButton@DirectUI@@QEAAXXZ	3634	0x14002d550
?SetString@ElementProxy@DirectUI@@IEAAJPEAUtagVARIANT@@P8Element@2@EAAPEBGPEAPEAVValue@2@@Z@Z	3635	0x140037984
?SetStyle@CCTreeView@DirectUI@@QEAAKK@Z	3636	0x14000d600
?SetSubContent@TouchCommandButton@DirectUI@@QEAAJPEBG@Z	3637	0x14001e670
?SetSuppressClearButton@TouchEdit2@DirectUI@@QEAAJ_N@Z	3638	0x140017fa8
?SetSuppressSetContact@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3639	0x1400313f4
?SetSyncContentWhileIMEComposing@TouchEditBase@DirectUI@@QEAAJ_N@Z	3640	0x140028a1c
?SetTargetPage@Navigator@DirectUI@@QEAAJPEBG@Z	3641	0x14000593c
?SetTextContentOverride@TouchSelectItem@DirectUI@@QEAAJPEBG@Z	3642	0x14001bc60
?SetTextGlowSize@Element@DirectUI@@QEAAJH@Z	3643	0x140017620
?SetTextMode@TouchEditBase@DirectUI@@QEAAJW4TouchEditTextMode@2@@Z	3644	0x14001b6f8
?SetThemeChanged@HWNDHost@DirectUI@@IEAAJH@Z	3645	0x140007fa4
?SetThemedBorder@Edit@DirectUI@@QEAAJ_N@Z	3646	0x140022e2c
?SetThumbPosition@CCTrackBar@DirectUI@@QEAAJH@Z	3647	0x14000b354
?SetThumbValue@TouchSlider@DirectUI@@QEAAXH_N0@Z	3648	0x140039b7c
?SetThumbValue@TouchSlider@DirectUI@@QEAAXH_N@Z	3649	0x140031744
?SetTickCount@TouchSlider@DirectUI@@QEAAJH@Z	3650	0x140023b48
?SetTitleText@TouchSwitch@DirectUI@@QEAAJPEBG@Z	3651	0x140006d64
?SetToHost@XBaby@DirectUI@@UEAAJPEAVElement@2@@Z	3652	0x14000500c
?SetToggleOnClick@TouchCheckBox@DirectUI@@QEAAJ_N@Z	3653	0x14000ad8c
?SetToggleSwitchText@TouchSwitch@DirectUI@@QEAAXPEBG@Z	3654	0x14002c744
?SetToggleValue@TouchSwitch@DirectUI@@QEAAXH@Z	3655	0x14003e6e8
?SetToggleValue@TouchSwitch@DirectUI@@QEAAXH_N0@Z	3656	0x140014cdc
?SetToggleValue@TouchSwitch@DirectUI@@QEAAXH_N@Z	3657	0x1400126a0
?SetTooltip@Element@DirectUI@@QEAAJ_N@Z	3658	0x140038904
?SetTooltipMaxWidth@Element@DirectUI@@QEAAJH@Z	3659	0x140030e28
?SetTooltipMaximumLineCount@TouchHWNDElement@DirectUI@@QEAAJH@Z	3660	0x14002df10
?SetTooltipText@TouchSlider@DirectUI@@QEAAXPEBG@Z	3661	0x140002298
?SetTracking@CCBaseScrollBar@DirectUI@@QEAAJ_N@Z	3662	0x14000b834
?SetTransparent@HWNDHost@DirectUI@@QEAAJ_N@Z	3663	0x14000893c
?SetTreatRightMouseButtonAsLeft@TouchButton@DirectUI@@QEAAJ_N@Z	3664	0x1400309a0
?SetTypography@RichText@DirectUI@@QEAAJPEBG@Z	3665	0x14001811c
?SetTypographyRuns@RichText@DirectUI@@QEAAJPEBG@Z	3666	0x14003d21c
?SetUnavailableIcon@DUIXmlParser@DirectUI@@QEAAXPEAUHICON__@@@Z	3667	0x14001f99c
?SetUnknownAttrCallback@DUIXmlParser@DirectUI@@QEAAXP6A_NPEBGPEAX@Z1@Z	3668	0x140034528
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z	3669	0x14000d944
?SetValue@Element@DirectUI@@QEAAJPEBUPropertyInfo@2@HPEAVValue@2@@Z	3670	0x140027c5c
?SetValue@RangeValueProvider@DirectUI@@UEAAJN@Z	3671	0x140025dfc
?SetValue@ValueProvider@DirectUI@@UEAAJPEBG@Z	3672	0x1400068cc
?SetValue@ValueProxy@DirectUI@@AEAAJPEBG@Z	3673	0x14000f134
?SetVertical@ScrollBar@DirectUI@@QEAAJ_N@Z	3674	0x1400040bc
?SetVerticalScript@RichText@DirectUI@@QEAAJ_N@Z	3675	0x140017728
?SetVirtualizeElements@TouchScrollViewer@DirectUI@@QEAAJ_N@Z	3676	0x1400167b0
?SetVisible@Element@DirectUI@@QEAAJ_N@Z	3677	0x140031e08
?SetVisited@TouchHyperLink@DirectUI@@QEAAJ_N@Z	3678	0x1400064dc
?SetWantTabs@Edit@DirectUI@@QEAAJ_N@Z	3679	0x140022fa4
?SetWidth@Element@DirectUI@@QEAAJH@Z	3680	0x14001ec00
?SetWinStyle@CCBase@DirectUI@@QEAAJH@Z	3681	0x14001896c
?SetWindowAccessGradientColor@TouchHWNDElement@DirectUI@@QEAAJPEAVValue@2@@Z	3682	0x14003896c
?SetWindowActive@Element@DirectUI@@QEAAJ_N@Z	3683	0x14001cb20
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z	3684	0x14002f7b4
?SetWrapKeyboardNavigate@HWNDElement@DirectUI@@QEAAJ_N@Z	3685	0x140027a88
?SetX@Element@DirectUI@@QEAAJH@Z	3686	0x140030a88
?SetXBarVisibility@BaseScrollViewer@DirectUI@@QEAAJH@Z	3687	0x1400070dc
?SetXML@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z	3688	0x140017bd4
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z	3689	0x1400378b4
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEBGPEAUHINSTANCE__@@1@Z	3690	0x14002a784
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJPEBG0PEAUHINSTANCE__@@1@Z	3691	0x14001e1b0
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z	3692	0x1400131e0
?SetXMLFromResourceWithTheme@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@00@Z	3693	0x14000aa7c
?SetXOffset@BaseScrollViewer@DirectUI@@QEAAJH@Z	3694	0x14001e6a8
?SetXOffset@Viewer@DirectUI@@QEAAJH@Z	3695	0x14003314c
?SetXScrollable@BaseScrollViewer@DirectUI@@QEAAJ_N@Z	3696	0x140003f98
?SetXScrollable@Viewer@DirectUI@@QEAAJ_N@Z	3697	0x14003e5c4
?SetY@Element@DirectUI@@QEAAJH@Z	3698	0x1400370bc
?SetYBarVisibility@BaseScrollViewer@DirectUI@@QEAAJH@Z	3699	0x14001d348
?SetYOffset@BaseScrollViewer@DirectUI@@QEAAJH@Z	3700	0x14002c314
?SetYOffset@Viewer@DirectUI@@QEAAJH@Z	3701	0x14002dc2c
?SetYScrollable@BaseScrollViewer@DirectUI@@QEAAJ_N@Z	3702	0x140015b40
?SetYScrollable@Viewer@DirectUI@@QEAAJ_N@Z	3703	0x140001900
?SetZoomMaximum@TouchScrollViewer@DirectUI@@QEAAJM@Z	3704	0x14000193c
?SetZoomMinimum@TouchScrollViewer@DirectUI@@QEAAJM@Z	3705	0x14000b598
?ShadowIntensityProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3706	0x14003cfb4
?SheetProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3707	0x14002e968
?ShiftChild@Element@DirectUI@@QEAAJII@Z	3708	0x14002322c
?ShortcutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3709	0x140008fe0
?ShouldUseDesktopPerMonitorScaling@HWNDElement@DirectUI@@QEAA_NXZ	3710	0x14001c6fc
?ShouldUsePerMonitorScaling@TouchHWNDElement@DirectUI@@QEAA_NXZ	3711	0x14001d13c
?ShowAccel@HWNDElement@DirectUI@@QEAA_NXZ	3712	0x14002bef4
?ShowClearButtonMinWidthProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3713	0x1400214a0
?ShowContextMenu@ElementProvider@DirectUI@@UEAAJXZ	3714	0x14002ee08
?ShowFocus@HWNDElement@DirectUI@@QEAA_NXZ	3715	0x1400176e8
?ShowKeyFocusProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3716	0x14001e47c
?ShowRichTooltip@TouchHWNDElement@DirectUI@@QEAAJW4TOUCHTOOLTIP_INPUT@@W4TOUCHTOOLTIP_OPTION_FLAGS@@PEAVElement@2@@Z	3717	0x140005f38
?ShowTickProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3718	0x1400093e8
?ShowTooltipOnRightForLTRBuild@TouchSlider@DirectUI@@QEAAXXZ	3719	0x140009ac0
?ShowUIState@HWNDElement@DirectUI@@QEAAX_N0@Z	3720	0x1400198e8
?ShowWindow@NativeHWNDHost@DirectUI@@QEAAXH@Z	3721	0x140012e48
?ShowWindow@XHost@DirectUI@@QEAAXH@Z	3722	0x140007948
?SideGraphicProp@TextGraphic@DirectUI@@SAPEBUPropertyInfo@2@XZ	3723	0x140031b80
?SizeInLayoutProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3724	0x140018998
?SizeZero@FlowLayout@DirectUI@@KA?AUtagSIZE@@XZ	3725	0x140025df4
?SizeZero@VerticalFlowLayout@DirectUI@@KA?AUtagSIZE@@XZ	3726	0x1400339f0
?Skip@DuiAccessible@DirectUI@@UEAAJK@Z	3727	0x140035748
?Skip@HWNDHostAccessible@DirectUI@@UEAAJK@Z	3728	0x14000e4d8
?SliderControlType@Schema@DirectUI@@2HA	3729	0x14001a598
?SliderUpdated@TouchSlider@DirectUI@@SA?AVUID@@XZ	3730	0x140010834
?SmoothingModeProp@Movie@DirectUI@@SAPEBUPropertyInfo@2@XZ	3731	0x140007ae0
?SnapIntervalXProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3732	0x1400257d8
?SnapIntervalYProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3733	0x1400369b0
?SnapModeProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3734	0x14003b61c
?SnapOffsetXProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3735	0x14001aac0
?SnapOffsetYProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3736	0x14001ce5c
?SnapPointCollectionXProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3737	0x140003e90
?SnapPointCollectionYProp@TouchScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3738	0x140040ee4
?SnapshotTransformElement@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3739	0x14000d974
?SortChildren@Element@DirectUI@@QEAAJP6AHPEBX0@Z@Z	3740	0x1400147fc
?SpinnerControlType@Schema@DirectUI@@2HA	3741	0x14003d580
?SplitButtonControlType@Schema@DirectUI@@2HA	3742	0x140014260
?Start@AnimationStrip@DirectUI@@AEAAJXZ	3743	0x1400188b4
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z	3744	0x140038ba4
?StartNavigate@Browser@DirectUI@@SA?AVUID@@XZ	3745	0x140023a00
?StartRichTooltipTimer@TouchHWNDElement@DirectUI@@QEAAJW4TOUCHTOOLTIP_INPUT@@@Z	3746	0x1400124a4
?StateProp@ModernProgressBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3747	0x140010754
?StaticWndProc@HWNDElement@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z	3748	0x1400368d0
?StaticXHostSubclassProc@TaskPage@DirectUI@@CA_JPEAUHWND__@@I_K_J@Z	3749	0x140017204
?StaticXmlParserError@TaskPage@DirectUI@@CAXPEBG0HPEAX@Z	3750	0x1400196e4
?StatusBarControlType@Schema@DirectUI@@2HA	3751	0x14003fd8c
?Stop@AnimationStrip@DirectUI@@AEAAXXZ	3752	0x140021fb4
?Stop@CCAVI@DirectUI@@QEAAXXZ	3753	0x140030ae8
?StopAnimation@Element@DirectUI@@QEAAXI@Z	3754	0x1400212c4
?StopUsingCache@RichText@DirectUI@@QEAAXXZ	3755	0x140026218
?StrDupW@Value@DirectUI@@CAJPEBGPEAPEAG@Z	3756	0x14001850c
?StructureChangedEvent@Schema@DirectUI@@2HA	3757	0x140028588
?SubContentProp@TouchCommandButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3758	0x14002fe08
?SuppressClearButtonProp@TouchEdit2@DirectUI@@SAPEBUPropertyInfo@2@XZ	3759	0x1400354c4
?SupressRightButtonDrag@Thumb@DirectUI@@QEAAX_N@Z	3760	0x140013c9c
?SyncBackground@HWNDHost@DirectUI@@IEAAXXZ	3761	0x14003bca0
?SyncCallback@Proxy@DirectUI@@SAJPEAUHGADGET__@@PEAXPEAUEventMsg@@@Z	3762	0x14001f4a0
?SyncColorsAndFonts@HWNDHost@DirectUI@@AEAAXXZ	3763	0x1400306b0
?SyncContentWhileIMEComposingProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3764	0x140009a00
?SyncDestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ	3765	0x14001d76c
?SyncDirection@HWNDHost@DirectUI@@IEAAXXZ	3766	0x14000a41c
?SyncElementAlphaFromForegroundAlpha@DirectUI@@YAXPEAVElement@1@@Z	3767	0x1400166e8
?SyncFont@HWNDHost@DirectUI@@IEAAXXZ	3768	0x14002b56c
?SyncForeground@HWNDHost@DirectUI@@IEAAXXZ	3769	0x14001d2b4
?SyncNoteAndGlyph@CCCommandLink@DirectUI@@IEAAXPEAUHWND__@@@Z	3770	0x140018bc0
?SyncParent@HWNDHost@DirectUI@@IEAAXXZ	3771	0x14000af54
?SyncRect@HWNDHost@DirectUI@@IEAAXI_N@Z	3772	0x14003e798
?SyncScrollBar@CCBaseScrollBar@DirectUI@@QEAAXXZ	3773	0x14003ce08
?SyncStyle@HWNDHost@DirectUI@@IEAAXXZ	3774	0x1400171a0
?SyncText@HWNDHost@DirectUI@@IEAAXXZ	3775	0x14004083c
?SyncVisible@HWNDHost@DirectUI@@IEAAXXZ	3776	0x140011fc4
?SystemAlertEvent@Schema@DirectUI@@2HA	3777	0x1400252e4
?TabControlType@Schema@DirectUI@@2HA	3778	0x14003f84c
?TabItemControlType@Schema@DirectUI@@2HA	3779	0x140036108
?TableControlType@Schema@DirectUI@@2HA	3780	0x14003f9c4
?TableItemPattern@Schema@DirectUI@@2HA	3781	0x140007fe0
?TableItem_ColumnHeaderItems_Property@Schema@DirectUI@@2HA	3782	0x140013810
?TableItem_RowHeaderItems_Property@Schema@DirectUI@@2HA	3783	0x14000a224
?TablePattern@Schema@DirectUI@@2HA	3784	0x140024c0c
?Table_ColumnHeaders_Property@Schema@DirectUI@@2HA	3785	0x140015dac
?Table_RowHeaders_Property@Schema@DirectUI@@2HA	3786	0x140038a48
?Table_RowOrColumnMajor_Property@Schema@DirectUI@@2HA	3787	0x14002f050
?TargetPageProp@Navigator@DirectUI@@SAPEBUPropertyInfo@2@XZ	3788	0x14002dd28
?TelemetrySetDescription@TouchScrollViewer@DirectUI@@QEAAJPEBG@Z	3789	0x140032014
?TestDeferObject@Element@DirectUI@@QEAAPEAVDeferCycle@2@XZ	3790	0x14000f574
?TextContentOverrideProp@TouchSelectItem@DirectUI@@SAPEBUPropertyInfo@2@XZ	3791	0x140036570
?TextControlType@Schema@DirectUI@@2HA	3792	0x140040164
?TextGlowSizeProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3793	0x14001b2c8
?TextModeProp@TouchEditBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3794	0x14003f214
?TextPattern@Schema@DirectUI@@2HA	3795	0x1400412d8
?TextTextSelectionChangedEvent@Schema@DirectUI@@2HA	3796	0x140001a08
?TextTooltipShowing@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3797	0x14000453c
?ThemeChange@HWNDElement@DirectUI@@SA?AVUID@@XZ	3798	0x14003e400
?ThemeChangedProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	3799	0x1400170d0
?ThemedBorderProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	3800	0x14000a8bc
?ThumbControlType@Schema@DirectUI@@2HA	3801	0x140031584
?ThumbPositionProp@CCTrackBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3802	0x140021104
?ThumbPositionProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3803	0x140040d24
?TickCountProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3804	0x14003e518
?TitleBarControlType@Schema@DirectUI@@2HA	3805	0x140039588
?TitleTextProp@TouchSwitch@DirectUI@@SAPEBUPropertyInfo@2@XZ	3806	0x140005ad4
?ToString@Value@DirectUI@@QEBAPEAGPEAGI@Z	3807	0x140003c84
?Toggle@AutoButton@DirectUI@@SA?AVUID@@XZ	3808	0x14000e6d4
?Toggle@SemanticZoomToggle@DirectUI@@SA?AVUID@@XZ	3809	0x14000eb3c
?Toggle@ToggleProvider@DirectUI@@UEAAJXZ	3810	0x14000e4dc
?ToggleOnClickProp@TouchCheckBox@DirectUI@@SAPEBUPropertyInfo@2@XZ	3811	0x14001db94
?TogglePattern@Schema@DirectUI@@2HA	3812	0x140020eb8
?ToggleUIState@HWNDElement@DirectUI@@QEAAX_N0@Z	3813	0x140006d38
?Toggle_ToggleState_Property@Schema@DirectUI@@2HA	3814	0x14002ea5c
?ToolBarControlType@Schema@DirectUI@@2HA	3815	0x140004188
?ToolTipClosedEvent@Schema@DirectUI@@2HA	3816	0x140031dc0
?ToolTipControlType@Schema@DirectUI@@2HA	3817	0x140009054
?ToolTipOpenedEvent@Schema@DirectUI@@2HA	3818	0x14001bde4
?TooltipMaxWidthProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3819	0x1400388e0
?TooltipMaximumLineCountProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3820	0x14002eebc
?TooltipProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3821	0x14001de28
?TooltipTimerStarting@TouchHWNDElement@DirectUI@@SA?AVUID@@XZ	3822	0x14003e7d4
?TossElement@ElementProvider@DirectUI@@UEAAXXZ	3823	0x140034db8
?TossPatternProvider@ElementProvider@DirectUI@@QEAAXW4Pattern@Schema@2@@Z	3824	0x14000890c
?TrackScore@NavScoring@DirectUI@@QEAAHPEAVElement@2@0@Z	3825	0x14002a980
?TrackingProp@CCBaseScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3826	0x140034f9c
?TransformPattern@Schema@DirectUI@@2HA	3827	0x140009c48
?TranslateThumbPositionToThumbValue@TouchSlider@DirectUI@@QEAAHH@Z	3828	0x140036320
?TransparentProp@HWNDHost@DirectUI@@SAPEBUPropertyInfo@2@XZ	3829	0x14000af8c
?TreatRightMouseButtonAsLeftProp@TouchButton@DirectUI@@SAPEBUPropertyInfo@2@XZ	3830	0x1400249f8
?TreeControlType@Schema@DirectUI@@2HA	3831	0x1400088a4
?TreeItemControlType@Schema@DirectUI@@2HA	3832	0x1400280d4
?TriggeredAnimationComplete@PVLAnimation@DirectUI@@SA?AVUID@@XZ	3833	0x1400244dc
?Try@NavScoring@DirectUI@@QEAAHPEAVElement@2@HPEBUNavReference@2@K@Z	3834	0x1400112f8
?TryLinePattern@Element@DirectUI@@AEAA_NPEAUtagPOINT@@AEBUtagRECT@@@Z	3835	0x140005198
?TryPattern@Element@DirectUI@@AEAA_NNNPEAUtagPOINT@@AEBUtagRECT@@@Z	3836	0x140003e44
?TrySparsePattern@Element@DirectUI@@AEAA_NPEAUtagPOINT@@AEBUtagRECT@@@Z	3837	0x1400096a0
?TypographyProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	3838	0x14003abcc
?TypographyRunsProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	3839	0x140027fd0
?UiaEvents@Element@DirectUI@@QEAA_NXZ	3840	0x1400215a4
?UiaHostProviderFromHwnd@Schema@DirectUI@@2P6AJPEAUHWND__@@PEAPEAUIRawElementProviderSimple@@@ZEA	3841	0x14002f480
?UiaLookupId@Schema@DirectUI@@2P6AHW4AutomationIdentifierType@@PEBU_GUID@@@ZEA	3842	0x140025b1c
?UiaRaiseAutomationEvent@Schema@DirectUI@@2P6AJPEAUIRawElementProviderSimple@@H@ZEA	3843	0x14002de40
?UiaRaiseAutomationPropertyChangedEvent@Schema@DirectUI@@2P6AJPEAUIRawElementProviderSimple@@HUtagVARIANT@@1@ZEA	3844	0x140036c34
?UiaRaiseStructureChangedEvent@Schema@DirectUI@@2P6AJPEAUIRawElementProviderSimple@@W4StructureChangeType@@PEAHH@ZEA	3845	0x140029fdc
?UiaReturnRawElementProvider@Schema@DirectUI@@2P6A_JPEAUHWND__@@_K_JPEAUIRawElementProviderSimple@@@ZEA	3846	0x1400140bc
?UnRegister@Element@DirectUI@@SAJPEAPEAUIClassInfo@2@@Z	3847	0x14002e880
?UnhandledSyschar@XElement@DirectUI@@SA?AVUID@@XZ	3848	0x140037948
?Uninit@CallstackTracker@DirectUI@@SAXXZ	3849	0x140014664
?Uninit@InvokeHelper@DirectUI@@QEAAXXZ	3850	0x14003ae7c
?UninitProcess@FontCache@DirectUI@@SAXXZ	3851	0x14003687c
?UninitThread@FontCache@DirectUI@@SAXXZ	3852	0x1400260c8
?UnloadCommonControlExports@AnimationStrip@DirectUI@@AEAAXXZ	3853	0x140029828
?Unlock@CritSecLock@DirectUI@@QEAAXXZ	3854	0x14001cd20
?UnregisterForAnimationStatusChanges@TouchHWNDElement@DirectUI@@QEAAXXZ	3855	0x140006d58
?UnregisterForIHMChanges@TouchHWNDElement@DirectUI@@QEAAXXZ	3856	0x140037ba8
?UnregisterForMonitorPowerChanges@TouchHWNDElement@DirectUI@@QEAAJXZ	3857	0x140009d64
?UnvirtualizePosition@HWNDHost@DirectUI@@AEAAXXZ	3858	0x1400134f8
?UpdateChildFocus@DialogElementCore@DirectUI@@QEAAXPEAVElement@2@0@Z	3859	0x140002e10
?UpdateChildren@Expando@DirectUI@@IEAAXPEAVValue@2@@Z	3860	0x1400325c8
?UpdateContentSize@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3861	0x14001c678
?UpdateDesiredSize@BorderLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3862	0x140029024
?UpdateDesiredSize@FillLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3863	0x140018014
?UpdateDesiredSize@FlowLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3864	0x140011f68
?UpdateDesiredSize@GridLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3865	0x14001fc68
?UpdateDesiredSize@Layout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3866	0x140008168
?UpdateDesiredSize@NineGridLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3867	0x1400404d4
?UpdateDesiredSize@RowLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3868	0x14002b0d0
?UpdateDesiredSize@TableLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3869	0x140034828
?UpdateDesiredSize@VerticalFlowLayout@DirectUI@@UEAA?AUtagSIZE@@PEAVElement@2@HHPEAVSurface@2@@Z	3870	0x140025dd8
?UpdateElement@TouchSelect@DirectUI@@QEAAJHPEAVElement@2@PEBG@Z	3871	0x140027df0
?UpdateLayout@Element@DirectUI@@QEAAXXZ	3872	0x1400044e4
?UpdateLayoutRect@Layout@DirectUI@@SAXPEAVElement@2@HH0HHHH@Z	3873	0x140029d28
?UpdateSheets@DUIXmlParser@DirectUI@@QEAAJPEAVElement@2@@Z	3874	0x140010e74
?UpdateString@TouchSelect@DirectUI@@QEAAJHPEBG@Z	3875	0x1400207a4
?UpdateStyleSheets@HWNDElement@DirectUI@@IEAAXXZ	3876	0x1400028e8
?UpdateToggleState@SemanticZoomToggle@DirectUI@@QEAAXW4SemanticZoomToggleState@@_N@Z	3877	0x14000d528
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z	3878	0x140003590
?UpdateTooltip@HWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3879	0x14002b9fc
?UpdateTooltip@TouchHWNDElement@DirectUI@@UEAAXPEAVElement@2@@Z	3880	0x14001eee0
?UpdateView@TouchScrollViewer@DirectUI@@SA?AVUID@@XZ	3881	0x14002e838
?UseFixedTooltipOffset@TouchSlider@DirectUI@@QEAAXXZ	3882	0x14001cb2c
?UsePerMonitorScaling@TouchHWNDElement@DirectUI@@QEAAXPEAUHMONITOR__@@@Z	3883	0x14001b484
?UserTextChanged@TouchEditBase@DirectUI@@SA?AVUID@@XZ	3884	0x140005720
?UserTextUpdateNoChange@TouchEditBase@DirectUI@@SA?AVUID@@XZ	3885	0x14003693c
?UsesDesktopPerMonitorScalingProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3886	0x14000d2a4
?ValuePattern@Schema@DirectUI@@2HA	3887	0x1400024ec
?Value_IsReadOnly_Property@Schema@DirectUI@@2HA	3888	0x140031830
?Value_Value_Property@Schema@DirectUI@@2HA	3889	0x140040eb4
?VerifyParentage@HWNDHost@DirectUI@@IEAAHXZ	3890	0x140010d20
?VerticalProp@ScrollBar@DirectUI@@SAPEBUPropertyInfo@2@XZ	3891	0x14001fe44
?VerticalScriptProp@RichText@DirectUI@@SAPEBUPropertyInfo@2@XZ	3892	0x140014dec
?VirtualizedItemPattern@Schema@DirectUI@@2HA	3893	0x14002cd48
?VisibleProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3894	0x14000f0d8
?VisitedProp@TouchHyperLink@DirectUI@@SAPEBUPropertyInfo@2@XZ	3895	0x14000f7d4
?VisualStateProp@TouchSlider@DirectUI@@SAPEBUPropertyInfo@2@XZ	3896	0x14001ee78
?WantEvent@EventManager@DirectUI@@CA_NW4Event@Schema@2@H@Z	3897	0x140028ac0
?WantEvent@EventManager@DirectUI@@SA_NW4Event@Schema@2@@Z	3898	0x140036e88
?WantPropertyEvent@EventManager@DirectUI@@SA_NH@Z	3899	0x140032714
?WantTabsProp@Edit@DirectUI@@SAPEBUPropertyInfo@2@XZ	3900	0x140016ec4
?WidthProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3901	0x1400205d8
?WinStyleProp@CCBase@DirectUI@@SAPEBUPropertyInfo@2@XZ	3902	0x1400390c4
?WindowAccessGradientColorProp@TouchHWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3903	0x140012334
?WindowActiveProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3904	0x14002ba10
?WindowControlType@Schema@DirectUI@@2HA	3905	0x140010434
?WindowDpiChanged@HWNDElement@DirectUI@@SA?AVUID@@XZ	3906	0x14003b1e0
?WindowPattern@Schema@DirectUI@@2HA	3907	0x140018e34
?WindowWindowClosedEvent@Schema@DirectUI@@2HA	3908	0x14000a684
?WindowWindowOpenedEvent@Schema@DirectUI@@2HA	3909	0x140002cb8
?WndProc@HWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z	3910	0x1400044fc
?WndProc@NativeHWNDHost@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z	3911	0x14002bba4
?WndProc@TouchHWNDElement@DirectUI@@UEAA_JPEAUHWND__@@I_K_J@Z	3912	0x140023e04
?WndProc@XHost@DirectUI@@SA_JPEAUHWND__@@I_K_J@Z	3913	0x14002f15c
?WrapKeyboardNavigateProp@HWNDElement@DirectUI@@SAPEBUPropertyInfo@2@XZ	3914	0x140032f10
?XBarVisibilityProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3915	0x140034660
?XOffsetProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3916	0x140001608
?XOffsetProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3917	0x14002e364
?XProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3918	0x14000a748
?XScrollableProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3919	0x140018e00
?XScrollableProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3920	0x14003505c
?YBarVisibilityProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3921	0x14002e08c
?YOffsetProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3922	0x140018030
?YOffsetProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3923	0x14002e0f8
?YProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ	3924	0x14003502c
?YScrollableProp@BaseScrollViewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3925	0x140016940
?YScrollableProp@Viewer@DirectUI@@SAPEBUPropertyInfo@2@XZ	3926	0x140001784
?ZoomToRect@TouchScrollViewer@DirectUI@@QEAAJPEBUtagRECT@@_N@Z	3927	0x14003228c
?ZoomToRectManualVisualSwap@TouchScrollViewer@DirectUI@@QEAAJMMMMPEBHMMM_N@Z	3928	0x140038474
?_AddDependency@Element@DirectUI@@SAXPEAV12@PEBUPropertyInfo@2@HPEAUDepRecs@2@PEAVDeferCycle@2@PEAJ@Z	3929	0x14000ef50
?_BitAccurateFillRect@Macro@DirectUI@@KAXPEAUHDC__@@HHHHEEEEK@Z	3930	0x140022554
?_BroadcastEventWorker@Element@DirectUI@@AEAAXPEAUEvent@2@@Z	3931	0x140011854
?_BuildChildren@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAVElement@2@@Z	3932	0x1400104fc
?_BuildElement@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAVElement@2@PEAPEAV42@@Z	3933	0x140011d30
?_BuildFromBinary@DUIXmlParser@DirectUI@@IEAAJPEAVElement@2@0PEBGPEAKPEAPEAV32@@Z	3934	0x14002ad34
?_BuildStyles@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	3935	0x14002d6c8
?_CachedValueIsEqual@Element@DirectUI@@AEAAHPEBUPropertyInfo@2@PEAV12@@Z	3936	0x1400212d4
?_CalcTabOrder@ShellBorderLayout@DirectUI@@AEAAJPEAVElement@2@@Z	3937	0x14002a01c
?_ClearNeedsLayout@Element@DirectUI@@QEAAXXZ	3938	0x14001913c
?_ClearTooltipState@TouchHWNDElement@DirectUI@@IEAAXXZ	3939	0x140016060
?_CreateAndSetLayout@DirectUI@@YAJPEAVElement@1@P6AJHPEAHPEAPEAVValue@1@@ZH1@Z	3940	0x14001a344
?_CreateValue@DUIXmlParser@DirectUI@@IEAAJPEBGPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	3941	0x14003dfa8
?_CtrlWndProc@HWNDHost@DirectUI@@CAHPEAXPEAUHWND__@@I_K_JPEA_J@Z	3942	0x140030c48
?_DeleteCtrlWnd@HWNDHost@DirectUI@@AEAAXXZ	3943	0x14003ba50
?_DestroyTables@DUIXmlParser@DirectUI@@QEAAXXZ	3944	0x140018820
?_DestroyTooltip@TouchHWNDElement@DirectUI@@IEAAXXZ	3945	0x14000d864
?_DisplayNodeCallback@Element@DirectUI@@SAJPEAUHGADGET__@@PEAXPEAUEventMsg@@@Z	3946	0x1400218c8
?_EndOptimizedLayoutQ@Element@DirectUI@@QEAAXXZ	3947	0x14000d5a8
?_EnterOnCurrentThread@DUIXmlParser@DirectUI@@IEAAJXZ	3948	0x140029f28
?_Fill@Element@DirectUI@@IEAAXPEAUHDC__@@KHHHH_N@Z	3949	0x140036308
?_FireWindowDpiChangeEvent@HWNDElement@DirectUI@@IEAAXXZ	3950	0x140011ce8
?_FlushDS@Element@DirectUI@@AEAAXPEAVDeferCycle@2@@Z	3951	0x1400284b8
?_FlushLayout@Element@DirectUI@@KAXPEAV12@PEAVDeferCycle@2@@Z	3952	0x14000f2f4
?_GetBitmapSize@Macro@DirectUI@@KA_NPEAUHBITMAP__@@PEAUtagSIZE@@@Z	3953	0x14002c710
?_GetBuriedSheetDependencies@Element@DirectUI@@AEAAXPEBUPropertyInfo@2@PEAV12@PEAUDepRecs@2@PEAVDeferCycle@2@PEAJ@Z	3954	0x1400137a0
?_GetChangesUpdatePass@Element@DirectUI@@QEAAHXZ	3955	0x14003da68
?_GetClassForElement@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAPEAUIClassInfo@2@@Z	3956	0x14000e6d4
?_GetClassForElementByName@DUIXmlParser@DirectUI@@IEAAJPEBGPEAPEAUIClassInfo@2@@Z	3957	0x14001c51c
?_GetComputedValue@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@PEAUUpdateCache@2@@Z	3958	0x140015bdc
?_GetContent@Viewer@DirectUI@@AEAAPEAVElement@2@XZ	3959	0x140011768
?_GetDependencies@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@HPEAUDepRecs@2@HPEAVValue@2@PEAVDeferCycle@2@@Z	3960	0x1400157dc
?_GetLineInfo@DUIXmlParser@DirectUI@@IEAA?AULINEINFO@2@PEAUIXmlReader@@@Z	3961	0x140008a80
?_GetLocalValue@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@@Z	3962	0x14003396c
?_GetLocalValueFromVM@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@@Z	3963	0x14000dfdc
?_GetNeedsLayout@Element@DirectUI@@QEAAIXZ	3964	0x1400130b0
?_GetPerMonitorScaleFactorForDesktopWindow@HWNDElement@DirectUI@@IEAAHPEAUHWND__@@@Z	3965	0x14002a744
?_GetPropertyForAttribute@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUIClassInfo@2@PEAPEBUPropertyInfo@2@@Z	3966	0x14003d254
?_GetSpecifiedValue@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@PEAUUpdateCache@2@@Z	3967	0x140019744
?_GetSpecifiedValueIgnoreCache@Element@DirectUI@@AEAAPEAVValue@2@PEBUPropertyInfo@2@@Z	3968	0x1400408a4
?_GetValueForStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEAUIClassInfo@2@PEBG1PEAPEBUPropertyInfo@2@PEAPEAVValue@2@@Z	3969	0x1400261b8
?_HandleImmersiveColorSchemeChange@HWNDElement@DirectUI@@IEAAXXZ	3970	0x14003f2c4
?_InheritProperties@Element@DirectUI@@AEAAXXZ	3971	0x1400321e4
?_InitializeTables@DUIXmlParser@DirectUI@@QEAAJXZ	3972	0x14001cc60
?_InternalEnsureVisible@Viewer@DirectUI@@AEAA_NHHHH@Z	3973	0x1400335c0
?_InvalidateCachedDSConstraints@Element@DirectUI@@KAXPEAV12@@Z	3974	0x14002ad80
?_IsSemanticZoomControl@ElementProxy@DirectUI@@AEAA_NH@Z	3975	0x140010140
?_IsWindowHostUsingDoNotStealFocusFlag@ElementProxy@DirectUI@@AEAA_NXZ	3976	0x14003f23c
?_LeaveOnCurrentThread@DUIXmlParser@DirectUI@@IEAAXXZ	3977	0x140033bbc
?_LoadImage32BitsPerPixel@Macro@DirectUI@@KAPEAVValue@2@PEBG@Z	3978	0x140032de8
?_MarkElementForDS@Element@DirectUI@@SAHPEAV12@@Z	3979	0x140038420
?_MarkElementForLayout@Element@DirectUI@@SAHPEAV12@I@Z	3980	0x14001c1e0
?_OnFontPropChanged@Element@DirectUI@@IEAAXPEAVValue@2@@Z	3981	0x140028510
?_OnGetInfoTip@CCTreeView@DirectUI@@MEAAJPEBUtagNMTVGETINFOTIPW@@@Z	3982	0x140003a80
?_OnItemChanged@CCTreeView@DirectUI@@MEAAJPEBUtagTVITEMCHANGE@@@Z	3983	0x14001ff34
?_OnUIStateChanged@HWNDElement@DirectUI@@MEAAXGG@Z	3984	0x140016d9c
?_OnUIStateChanged@TouchHWNDElement@DirectUI@@MEAAXGG@Z	3985	0x140026e84
?_ParseBehavior@DUIXmlParser@DirectUI@@IEAAJPEAVElement@2@PEBG@Z	3986	0x14003b430
?_ParseLayout@DUIXmlParser@DirectUI@@IEAAJPEBGPEAPEAVValue@2@@Z	3987	0x140005368
?_ParseValue@DUIXmlParser@DirectUI@@IEAAJPEBUPropertyInfo@2@PEBGPEAPEAVValue@2@@Z	3988	0x140034fec
?_PostEvent@Element@DirectUI@@AEAAXPEAUEvent@2@H@Z	3989	0x14001dc18
?_PostSourceChange@Element@DirectUI@@AEAAJXZ	3990	0x14002d108
?_PreSourceChange@Element@DirectUI@@AEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@1@Z	3991	0x14000e274
?_PreSourceChange@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@HPEAVValue@2@1@Z	3992	0x140017594
?_RecordElementBehaviors@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBG@Z	3993	0x140008d24
?_RecordElementLayout@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBG@Z	3994	0x1400094c4
?_RecordElementStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEBG_N@Z	3995	0x140040938
?_RecordElementTrees@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	3996	0x1400233d8
?_RecordElementWithChildren@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@_NPEAPEAG@Z	3997	0x140040fc0
?_RecordInstantiateElement@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAPEAG@Z	3998	0x14003d5e0
?_RecordSetElementProperties@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@@Z	3999	0x1400069c0
?_RecordSetValue@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEBG1@Z	4000	0x14000a9cc
?_RemoveLocalValue@Element@DirectUI@@IEAAJP6APEBUPropertyInfo@2@XZ_N@Z	4001	0x14003b694
?_RemoveLocalValue@Element@DirectUI@@IEAAJPEBUPropertyInfo@2@_N@Z	4002	0x14000aed8
?_RepeatButtonActionCallback@RepeatButton@DirectUI@@CAXPEAUGMA_ACTIONINFO@@@Z	4003	0x140029078
?_Reset@ShellBorderLayout@DirectUI@@AEAAXXZ	4004	0x14001f720
?_ResolveStyleSheet@DUIXmlParser@DirectUI@@IEAAJPEBGPEAPEAVValue@2@PEAI@Z	4005	0x14002d188
?_ScalePointsToPixels@DUIXmlParser@DirectUI@@AEBAHH@Z	4006	0x140026ae0
?_ScalePointsToPixels@DUIXmlParser@DirectUI@@AEBAMM@Z	4007	0x14000c7fc
?_ScaleRelativePixels@DUIXmlParser@DirectUI@@AEBAHH@Z	4008	0x140013eb8
?_ScaleRelativePixels@DUIXmlParser@DirectUI@@AEBAMM@Z	4009	0x14002c5f8
?_SelfLayoutDoLayout@Clipper@DirectUI@@UEAAXHH@Z	4010	0x140031574
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z	4011	0x140020d94
?_SelfLayoutDoLayout@ScrollBar@DirectUI@@UEAAXHH@Z	4012	0x14000cb5c
?_SelfLayoutDoLayout@TouchScrollBar@DirectUI@@UEAAXHH@Z	4013	0x140001920
?_SelfLayoutDoLayout@Viewer@DirectUI@@UEAAXHH@Z	4014	0x140029d48
?_SelfLayoutUpdateDesiredSize@Clipper@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4015	0x140006710
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4016	0x14003d088
?_SelfLayoutUpdateDesiredSize@ScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4017	0x140034008
?_SelfLayoutUpdateDesiredSize@TouchScrollBar@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4018	0x14000c318
?_SelfLayoutUpdateDesiredSize@Viewer@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4019	0x14000afbc
?_SetBinaryXml@DUIXmlParser@DirectUI@@IEAAJPEBE_KPEAUHINSTANCE__@@@Z	4020	0x140019058
?_SetGroupChanges@Element@DirectUI@@SA_NPEAV12@HPEAVDeferCycle@2@@Z	4021	0x140032b68
?_SetNeedsLayout@Element@DirectUI@@QEAAHI@Z	4022	0x140004aec
?_SetProperties@DUIXmlParser@DirectUI@@IEAAJPEAUIXmlReader@@PEAUIClassInfo@2@PEAVElement@2@@Z	4023	0x14001b7c4
?_SetRelPixRect@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@HHHH@Z	4024	0x140032a00
?_SetRelPixValue@Element@DirectUI@@AEAAJPEBUPropertyInfo@2@H@Z	4025	0x14002a94c
?_SetValue@Element@DirectUI@@IEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@_N@Z	4026	0x14002a69c
?_SetValue@Element@DirectUI@@IEAAJPEBUPropertyInfo@2@HPEAVValue@2@_N@Z	4027	0x140027ca0
?_SetXMLFromResource@DUIXmlParser@DirectUI@@IEAAJPEBG0PEAUHINSTANCE__@@11@Z	4028	0x1400182d8
?_SetupParserState@DUIXmlParser@DirectUI@@IEAAJPEAUHINSTANCE__@@0@Z	4029	0x140037db4
?_SinkWndProc@HWNDHost@DirectUI@@CAHPEAXPEAUHWND__@@I_K_JPEA_J@Z	4030	0x14002a8f8
?_StartOptimizedLayoutQ@Element@DirectUI@@QEAAXXZ	4031	0x1400102f8
?_SyncBackground@Element@DirectUI@@AEAAXXZ	4032	0x14000f41c
?_SyncRedrawStyle@Element@DirectUI@@AEAAXXZ	4033	0x140019db4
?_SyncVisible@Element@DirectUI@@AEAAXXZ	4034	0x140032d90
?_TransferGroupFlags@Element@DirectUI@@SAXPEAV12@H@Z	4035	0x14003bbe4
?_UpdateDesiredSize@Element@DirectUI@@QEAA?AUtagSIZE@@HHPEAVSurface@2@@Z	4036	0x140038938
?_UpdateDesktopScaleFactor@HWNDElement@DirectUI@@AEAAHXZ	4037	0x14003e21c
?_UpdateLayoutPosition@Element@DirectUI@@QEAAXHH@Z	4038	0x14002c674
?_UpdateLayoutSize@Element@DirectUI@@QEAAXHH@Z	4039	0x1400266d0
?_UpdatePropertyInCache@Element@DirectUI@@AEAAXPEBUPropertyInfo@2@@Z	4040	0x1400163c0
?_UpdateTileList@NineGridLayout@DirectUI@@AEAAXHPEAVElement@2@@Z	4041	0x14002b69c
?_UsesUIAProxies@ElementProxy@DirectUI@@IEAAHXZ	4042	0x140026428
?_VoidPCNotifyTree@Element@DirectUI@@CAXHPEAVDeferCycle@2@@Z	4043	0x14001eaa8
?_WndProc@InvokeHelper@DirectUI@@CAHPEAXPEAUHWND__@@I_K_JPEA_J@Z	4044	0x14003a694
?_ZeroRelease@Value@DirectUI@@AEAAXXZ	4045	0x14000d254
?_atmArrow@Expando@DirectUI@@0GA	4046	0x14003e150
?_atmClipper@Expando@DirectUI@@0GA	4047	0x14001f2bc
?_roleMapping@Schema@DirectUI@@0QBURoleMap@12@B	4048	0x14003fcdc
?accDoDefaultAction@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@@Z	4049	0x14003548c
?accDoDefaultAction@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@@Z	4050	0x14000a568
?accHitTest@DuiAccessible@DirectUI@@UEAAJJJPEAUtagVARIANT@@@Z	4051	0x140020464
?accHitTest@HWNDHostAccessible@DirectUI@@UEAAJJJPEAUtagVARIANT@@@Z	4052	0x140009790
?accLocation@DuiAccessible@DirectUI@@UEAAJPEAJ000UtagVARIANT@@@Z	4053	0x14003b020
?accLocation@HWNDHostAccessible@DirectUI@@UEAAJPEAJ000UtagVARIANT@@@Z	4054	0x140013af8
?accNavigate@DuiAccessible@DirectUI@@UEAAJJUtagVARIANT@@PEAU3@@Z	4055	0x1400143a8
?accNavigate@HWNDHostAccessible@DirectUI@@UEAAJJUtagVARIANT@@PEAU3@@Z	4056	0x140030fd4
?accNavigate@HWNDHostClientAccessible@DirectUI@@UEAAJJUtagVARIANT@@PEAU3@@Z	4057	0x140003ba0
?accSelect@DuiAccessible@DirectUI@@UEAAJJUtagVARIANT@@@Z	4058	0x14002fd68
?accSelect@HWNDHostAccessible@DirectUI@@UEAAJJUtagVARIANT@@@Z	4059	0x140009354
?advanceFrameActionStart@Movie@DirectUI@@AEAAXXZ	4060	0x14003df58
?advanceFrameActionStop@Movie@DirectUI@@AEAAXXZ	4061	0x1400159d4
?cChangeBulk@EventManager@DirectUI@@0HB	4062	0x140003dd4
?c_RefCountBitOffset@Value@DirectUI@@0HB	4063	0x140035454
?c_RefCountMask@Value@DirectUI@@0JB	4064	0x14000fe00
?c_SingleRefCount@Value@DirectUI@@0JB	4065	0x140026104
?c_rgar@AccessibleButton@DirectUI@@0QBUACCESSIBLEROLE@12@B	4066	0x14002ef84
?doAction@Movie@DirectUI@@QEAAXPEAUGMA_ACTIONINFO@@@Z	4067	0x14001e5a0
?g_cRefCount@ResourceModuleHandles@DirectUI@@0JC	4068	0x1400152c8
?g_controlInfoTable@Schema@DirectUI@@0QBUControlInfo@12@B	4069	0x14000c414
?g_cs@ElementProviderManager@DirectUI@@2U_RTL_CRITICAL_SECTION@@A	4070	0x14003a54c
?g_cs@EventManager@DirectUI@@0U_RTL_CRITICAL_SECTION@@A	4071	0x140032980
?g_cs@InvokeManager@DirectUI@@0U_RTL_CRITICAL_SECTION@@A	4072	0x1400341f8
?g_dwElSlot@DirectUI@@3KA	4073	0x140034418
?g_eventInfoTable@Schema@DirectUI@@0QBUEventInfo@12@B	4074	0x14002a88c
?g_eventMapping@Schema@DirectUI@@0QBUEventMap@12@B	4075	0x14001e67c
?g_eventRegisteredMap@EventManager@DirectUI@@0PAIA	4076	0x140017db8
?g_fInited@Schema@DirectUI@@0_NA	4077	0x1400060f0
?g_fWantAnyEvent@EventManager@DirectUI@@0_NA	4078	0x14002c75c
?g_pArrayInvokeHelper@InvokeManager@DirectUI@@0PEAV?$UiaArray@PEAVInvokeHelper@DirectUI@@@2@EA	4079	0x14003835c
?g_pArrayPprv@ElementProviderManager@DirectUI@@0PEAV?$UiaArray@PEAVElementProvider@DirectUI@@@2@EA	4080	0x14001b7a8
?g_pArrayPropertyEvent@EventManager@DirectUI@@0PEAV?$UiaArray@H@2@EA	4081	0x140025d50
?g_patternInfoTable@Schema@DirectUI@@0QBUPatternInfo@12@B	4082	0x1400136e0
?g_patternMapping@Schema@DirectUI@@0QBUPatternMap@12@B	4083	0x14000e27c
?g_propertyInfoTable@Schema@DirectUI@@0QBUPropertyInfo@12@B	4084	0x14000a678
?g_rgMouseMap@HWNDHost@DirectUI@@0QAY02$$CBIA	4085	0x140040c60
?get_BoundingRectangle@ElementProvider@DirectUI@@UEAAJPEAUUiaRect@@@Z	4086	0x140015d2c
?get_CanSelectMultiple@SelectionProvider@DirectUI@@UEAAJPEAH@Z	4087	0x14000ae9c
?get_Column@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4088	0x14000ed34
?get_ColumnCount@GridProvider@DirectUI@@UEAAJPEAH@Z	4089	0x140036444
?get_ColumnSpan@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4090	0x1400313e4
?get_ContainingGrid@GridItemProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z	4091	0x140025dd4
?get_ExpandCollapseState@ExpandCollapseProvider@DirectUI@@UEAAJPEAW4ExpandCollapseState@@@Z	4092	0x1400290ac
?get_FragmentRoot@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderFragmentRoot@@@Z	4093	0x14001f5c4
?get_HorizontalScrollPercent@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4094	0x14001f314
?get_HorizontalViewSize@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4095	0x1400188a0
?get_HorizontallyScrollable@ScrollProvider@DirectUI@@UEAAJPEAH@Z	4096	0x14001db70
?get_HostRawElementProvider@ElementProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z	4097	0x1400319c8
?get_IsReadOnly@RangeValueProvider@DirectUI@@UEAAJPEAH@Z	4098	0x140006b4c
?get_IsReadOnly@ValueProvider@DirectUI@@UEAAJPEAH@Z	4099	0x14002960c
?get_IsSelected@SelectionItemProvider@DirectUI@@UEAAJPEAH@Z	4100	0x14001bdec
?get_IsSelectionRequired@SelectionProvider@DirectUI@@UEAAJPEAH@Z	4101	0x140028844
?get_LargeChange@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4102	0x1400200f0
?get_Maximum@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4103	0x14003efa4
?get_Minimum@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4104	0x140022050
?get_ProviderOptions@ElementProvider@DirectUI@@UEAAJPEAW4ProviderOptions@@@Z	4105	0x140015d2c
?get_Row@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4106	0x14001d620
?get_RowCount@GridProvider@DirectUI@@UEAAJPEAH@Z	4107	0x140040d50
?get_RowOrColumnMajor@TableProvider@DirectUI@@UEAAJPEAW4RowOrColumnMajor@@@Z	4108	0x1400059e4
?get_RowSpan@GridItemProvider@DirectUI@@UEAAJPEAH@Z	4109	0x14003dc74
?get_SelectionContainer@SelectionItemProvider@DirectUI@@UEAAJPEAPEAUIRawElementProviderSimple@@@Z	4110	0x14000650c
?get_SmallChange@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4111	0x140015440
?get_ToggleState@ToggleProvider@DirectUI@@UEAAJPEAW4ToggleState@@@Z	4112	0x14003c964
?get_Value@RangeValueProvider@DirectUI@@UEAAJPEAN@Z	4113	0x1400223f8
?get_Value@ValueProvider@DirectUI@@UEAAJPEAPEAG@Z	4114	0x140005058
?get_VerticalScrollPercent@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4115	0x1400318a0
?get_VerticalViewSize@ScrollProvider@DirectUI@@UEAAJPEAN@Z	4116	0x140009108
?get_VerticallyScrollable@ScrollProvider@DirectUI@@UEAAJPEAH@Z	4117	0x1400350b8
?get_accChild@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAUIDispatch@@@Z	4118	0x14002b608
?get_accChild@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAUIDispatch@@@Z	4119	0x1400221ec
?get_accChildCount@DuiAccessible@DirectUI@@UEAAJPEAJ@Z	4120	0x14000924c
?get_accChildCount@HWNDHostAccessible@DirectUI@@UEAAJPEAJ@Z	4121	0x140002604
?get_accDefaultAction@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4122	0x140027414
?get_accDefaultAction@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4123	0x140013d0c
?get_accDescription@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4124	0x14003b4f4
?get_accDescription@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4125	0x140012cb0
?get_accFocus@DuiAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4126	0x140012f14
?get_accFocus@HWNDHostAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4127	0x14002eb40
?get_accHelp@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4128	0x140014560
?get_accHelp@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4129	0x14003480c
?get_accHelpTopic@DuiAccessible@DirectUI@@UEAAJPEAPEAGUtagVARIANT@@PEAJ@Z	4130	0x140016cc4
?get_accHelpTopic@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAGUtagVARIANT@@PEAJ@Z	4131	0x140034314
?get_accKeyboardShortcut@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4132	0x14001b650
?get_accKeyboardShortcut@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4133	0x14001bbac
?get_accName@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4134	0x14000b0e8
?get_accName@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4135	0x140021ae0
?get_accParent@DuiAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4136	0x140019560
?get_accParent@HWNDElementAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4137	0x14003a908
?get_accParent@HWNDHostAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4138	0x140035a00
?get_accParent@HWNDHostClientAccessible@DirectUI@@UEAAJPEAPEAUIDispatch@@@Z	4139	0x140026384
?get_accRole@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4140	0x14003755c
?get_accRole@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4141	0x140017358
?get_accRole@HWNDHostClientAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4142	0x140031d64
?get_accSelection@DuiAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4143	0x140040c74
?get_accSelection@HWNDHostAccessible@DirectUI@@UEAAJPEAUtagVARIANT@@@Z	4144	0x140031a54
?get_accState@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4145	0x14003735c
?get_accState@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAU3@@Z	4146	0x140006590
?get_accValue@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4147	0x14001fea4
?get_accValue@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAPEAG@Z	4148	0x14002383c
?put_accName@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4149	0x140014684
?put_accName@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4150	0x140014074
?put_accValue@DuiAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4151	0x14003a930
?put_accValue@HWNDHostAccessible@DirectUI@@UEAAJUtagVARIANT@@PEAG@Z	4152	0x14002af84
?s_HandleDUIEventMessage@Element@DirectUI@@CA_NPEAV12@PEAUEventMsg@@@Z	4153	0x14002d8f8
?s_ImageHlpFuncList@CallstackTracker@DirectUI@@0PAUIMGHLPFN_LOAD@12@A	4154	0x140006a54
?s_SyncCallback@CSafeElementProxy@@SAJPEAUHGADGET__@@PEAXPEAUEventMsg@@@Z	4155	0x14001fe4c
?s_XMLParseError@DUIFactory@DirectUI@@CAXPEBG0HPEAX@Z	4156	0x14000ab48
?s_fdClr@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@K@12@B	4157	0x1400205c0
?s_fdFill@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@PEAVValue@DirectUI@@@12@B	4158	0x140016930
?s_fdGraphic@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@PEAVValue@DirectUI@@@12@B	4159	0x14003d584
?s_fdInt@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@H@12@B	4160	0x140010dac
?s_fdRect@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@UScaledRECT@DirectUI@@@12@B	4161	0x14002de84
?s_fdSize@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@UScaledSIZE@DirectUI@@@12@B	4162	0x140013b28
?s_fdString@DUIXmlParser@DirectUI@@1QBU?$FunctionDefinition@PEAVValue@DirectUI@@@12@B	4163	0x140021cf0
?s_hProcess@CallstackTracker@DirectUI@@0PEAXEA	4164	0x140022008
?s_hinstImageHlp@CallstackTracker@DirectUI@@0PEAUHINSTANCE__@@EA	4165	0x140018814
?s_hinstNtDll@CallstackTracker@DirectUI@@0PEAUHINSTANCE__@@EA	4166	0x140030ffc
?s_initonceInit@CallstackTracker@DirectUI@@0T_RTL_RUN_ONCE@@A	4167	0x14003e2b0
?s_pClassInfo@AccessibleButton@DirectUI@@0PEAUIClassInfo@2@EA	4168	0x14000b36c
?s_pClassInfo@AnimationStrip@DirectUI@@0PEAUIClassInfo@2@EA	4169	0x1400385c8
?s_pClassInfo@AutoButton@DirectUI@@0PEAUIClassInfo@2@EA	4170	0x1400203b4
?s_pClassInfo@BaseScrollViewer@DirectUI@@0PEAUIClassInfo@2@EA	4171	0x1400024d0
?s_pClassInfo@Bind@DirectUI@@0PEAUIClassInfo@2@EA	4172	0x140023054
?s_pClassInfo@Browser@DirectUI@@0PEAUIClassInfo@2@EA	4173	0x140036680
?s_pClassInfo@Button@DirectUI@@0PEAUIClassInfo@2@EA	4174	0x14003ece0
?s_pClassInfo@CCAVI@DirectUI@@0PEAUIClassInfo@2@EA	4175	0x140001d98
?s_pClassInfo@CCBase@DirectUI@@0PEAUIClassInfo@2@EA	4176	0x140028ae0
?s_pClassInfo@CCBaseCheckRadioButton@DirectUI@@0PEAUIClassInfo@2@EA	4177	0x14002b820
?s_pClassInfo@CCBaseScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4178	0x14002b6e4
?s_pClassInfo@CCCheckBox@DirectUI@@0PEAUIClassInfo@2@EA	4179	0x14002a4a4
?s_pClassInfo@CCCommandLink@DirectUI@@0PEAUIClassInfo@2@EA	4180	0x140038e34
?s_pClassInfo@CCHScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4181	0x14001ca20
?s_pClassInfo@CCListBox@DirectUI@@0PEAUIClassInfo@2@EA	4182	0x14002681c
?s_pClassInfo@CCListView@DirectUI@@0PEAUIClassInfo@2@EA	4183	0x140017630
?s_pClassInfo@CCProgressBar@DirectUI@@0PEAUIClassInfo@2@EA	4184	0x14003c580
?s_pClassInfo@CCPushButton@DirectUI@@0PEAUIClassInfo@2@EA	4185	0x14003e234
?s_pClassInfo@CCRadioButton@DirectUI@@0PEAUIClassInfo@2@EA	4186	0x140030750
?s_pClassInfo@CCSysLink@DirectUI@@0PEAUIClassInfo@2@EA	4187	0x140029728
?s_pClassInfo@CCTrackBar@DirectUI@@0PEAUIClassInfo@2@EA	4188	0x14002f920
?s_pClassInfo@CCTreeView@DirectUI@@0PEAUIClassInfo@2@EA	4189	0x1400073c8
?s_pClassInfo@CCVScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4190	0x140001d80
?s_pClassInfo@CheckBoxGlyph@DirectUI@@0PEAUIClassInfo@2@EA	4191	0x140041368
?s_pClassInfo@Clipper@DirectUI@@0PEAUIClassInfo@2@EA	4192	0x14003ad28
?s_pClassInfo@Combobox@DirectUI@@0PEAUIClassInfo@2@EA	4193	0x14003a674
?s_pClassInfo@DialogElement@DirectUI@@0PEAUIClassInfo@2@EA	4194	0x1400094c4
?s_pClassInfo@Edit@DirectUI@@0PEAUIClassInfo@2@EA	4195	0x140020ea4
?s_pClassInfo@Element@DirectUI@@0PEAUIClassInfo@2@EA	4196	0x140011fc4
?s_pClassInfo@ElementWithHWND@DirectUI@@0PEAUIClassInfo@2@EA	4197	0x14002b394
?s_pClassInfo@Expandable@DirectUI@@0PEAUIClassInfo@2@EA	4198	0x14000c2ac
?s_pClassInfo@Expando@DirectUI@@0PEAUIClassInfo@2@EA	4199	0x140029484
?s_pClassInfo@ExpandoButtonGlyph@DirectUI@@0PEAUIClassInfo@2@EA	4200	0x14001f4e0
?s_pClassInfo@HWNDElement@DirectUI@@0PEAUIClassInfo@2@EA	4201	0x14003626c
?s_pClassInfo@HWNDHost@DirectUI@@0PEAUIClassInfo@2@EA	4202	0x140007ecc
?s_pClassInfo@Macro@DirectUI@@0PEAUIClassInfo@2@EA	4203	0x140008a64
?s_pClassInfo@Movie@DirectUI@@0PEAUIClassInfo@2@EA	4204	0x14000e91c
?s_pClassInfo@Navigator@DirectUI@@0PEAUIClassInfo@2@EA	4205	0x140018254
?s_pClassInfo@PText@DirectUI@@0PEAUIClassInfo@2@EA	4206	0x14001c880
?s_pClassInfo@Page@DirectUI@@0PEAUIClassInfo@2@EA	4207	0x14002a63c
?s_pClassInfo@Pages@DirectUI@@0PEAUIClassInfo@2@EA	4208	0x14001763c
?s_pClassInfo@Progress@DirectUI@@0PEAUIClassInfo@2@EA	4209	0x14001b110
?s_pClassInfo@PushButton@DirectUI@@0PEAUIClassInfo@2@EA	4210	0x140039d54
?s_pClassInfo@RadioButtonGlyph@DirectUI@@0PEAUIClassInfo@2@EA	4211	0x14001c860
?s_pClassInfo@RefPointElement@DirectUI@@0PEAUIClassInfo@2@EA	4212	0x14002d62c
?s_pClassInfo@RepeatButton@DirectUI@@0PEAUIClassInfo@2@EA	4213	0x140008ef0
?s_pClassInfo@Repeater@DirectUI@@0PEAUIClassInfo@2@EA	4214	0x14002c534
?s_pClassInfo@ScrollBar@DirectUI@@0PEAUIClassInfo@2@EA	4215	0x14003d764
?s_pClassInfo@ScrollViewer@DirectUI@@0PEAUIClassInfo@2@EA	4216	0x1400308a4
?s_pClassInfo@Selector@DirectUI@@0PEAUIClassInfo@2@EA	4217	0x140001e98
?s_pClassInfo@SelectorNoDefault@DirectUI@@0PEAUIClassInfo@2@EA	4218	0x140034a3c
?s_pClassInfo@StyledScrollViewer@DirectUI@@0PEAUIClassInfo@2@EA	4219	0x14001bd74
?s_pClassInfo@TextGraphic@DirectUI@@0PEAUIClassInfo@2@EA	4220	0x140023074
?s_pClassInfo@Thumb@DirectUI@@0PEAUIClassInfo@2@EA	4221	0x14001645c
?s_pClassInfo@UnknownElement@DirectUI@@0PEAUIClassInfo@2@EA	4222	0x1400366dc
?s_pClassInfo@Viewer@DirectUI@@0PEAUIClassInfo@2@EA	4223	0x140034404
?s_pClassInfo@XBaby@DirectUI@@0PEAUIClassInfo@2@EA	4224	0x14000834c
?s_pClassInfo@XElement@DirectUI@@0PEAUIClassInfo@2@EA	4225	0x14002e6e8
?s_pfnImagehlpApiVersionEx@CallstackTracker@DirectUI@@0P6APEAUAPI_VERSION@@PEAU3@@ZEA	4226	0x140025d20
?s_pfnRtlCaptureStackBackTrace@CallstackTracker@DirectUI@@0P6AGKKPEAPEAXPEAK@ZEA	4227	0x14002d1a8
?s_pfnSymFromAddr@CallstackTracker@DirectUI@@0P6AHPEAX_KPEA_KPEAU_SYMBOL_INFO@@@ZEA	4228	0x14002e458
?s_pfnSymGetModuleInfo64@CallstackTracker@DirectUI@@0P6AHPEAX_KPEAU_IMAGEHLP_MODULE64@@@ZEA	4229	0x1400054d0
?s_pfnSymInitialize@CallstackTracker@DirectUI@@0P6AHPEAXPEBDH@ZEA	4230	0x14001cf7c
?s_pfnSymLoadModule64@CallstackTracker@DirectUI@@0P6A_KPEAX0PEBD1_KK@ZEA	4231	0x14002caf8
?s_pfnSymSetOptions@CallstackTracker@DirectUI@@0P6AKK@ZEA	4232	0x1400084dc
?s_uButtonFocusChangeMsg@XElement@DirectUI@@2IB	4233	0x140017a0c
?s_uInvokeHelperMsg@InvokeHelper@DirectUI@@0IB	4234	0x140026b84
?s_uNavigateOutMsg@XElement@DirectUI@@2IB	4235	0x14002e2ec
?s_uUnhandledSyscharMsg@XElement@DirectUI@@2IB	4236	0x14002f804
ARGBColorFromEnumI	4237	0x140036a20
AllowAllScalingPlateaus	4238	0x140035f90
BlurBitmap	4239	0x14000f16c
BrushFromEnumI	4240	0x140037468
ColorFromEnumI	4241	0x1400140d8
CreateDUIWrapper	4242	0x140034160
CreateDUIWrapperEx	4243	0x140020558
CreateDUIWrapperFromResource	4244	0x140034280
CreateDUIWrapperTouchEx	1274	0x140022f30
CreateTouchTooltip	4245	0x14000c8fc
DUI70_DUIXmlParserCreate	4246	0x14000d67c
DUI70_DUIXmlParserCreateElement	4247	0x1400120d4
DUI70_DUIXmlParserDestroy	4248	0x14001e660
DUI70_DUIXmlParserSetXMLFromResource	4249	0x140020518
DUI70_ElementAddListener	4250	0x14000a190
DUI70_ElementDestroy	4251	0x1400150dc
DUI70_ElementEndDefer	4252	0x1400113b0
DUI70_ElementFindDescendent	4253	0x14001c39c
DUI70_ElementGetChildren	4254	0x14002de6c
DUI70_ElementGetRoot	4255	0x14003c674
DUI70_ElementRemoveListener	4256	0x1400385b8
DUI70_ElementSetAccRole	4257	0x14002d7d0
DUI70_ElementSetAccessible	4258	0x14000b860
DUI70_ElementSetContentAlign	4259	0x140016e88
DUI70_ElementSetContentString	4260	0x14001fd90
DUI70_ElementSetFont	4261	0x140008548
DUI70_ElementSetID	4262	0x14003578c
DUI70_ElementSetLayoutPos	4263	0x14000f6a8
DUI70_ElementSetVisible	4264	0x140017ab4
DUI70_ElementStartDefer	4265	0x14003b79c
DUI70_IsTouchButtonClickEqual	4266	0x14000fa2c
DUI70_RichTextCreate	4267	0x140024d00
DUI70_RichTextSetConstrainLayout	4268	0x140013b40
DUI70_ValueRelease	4269	0x140020c14
DUIDrawShadowText	4270	0x14001a5bc
DUIStopPVLAnimation	4271	0x140040ae4
DisableAnimations	4272	0x14001e91c
DisableInitCallstackTracking	4273	0x14003f958
DrawShadowTextEx	4274	0x140011298
DuiCreateObject	1442	0x1400201e4
ElementFromGadget	4275	0x140028590
EnableAnimations	4276	0x14000f538
FlushThemeHandles	4277	0x140015b60
ForceDebugBreak	4278	0x1400146ec
GetDesktopDPI	4279	0x14002315c
GetElementDataEntry	4280	0x140023144
GetElementMacro	4281	0x14002b0c4
GetFontCache	4282	0x14000bf78
GetScaleFactor	4283	0x14000ab90
GetThemeHandle	4284	0x140021044
HStrDup	4285	0x14002d180
HrSysAllocString	4286	0x14002dc7c
InitPreprocessor	4287	0x1400255e8
InitProcessPriv	4288	0x140022540
InitThread	4289	0x1400079f8
IsAnimationsEnabled	4290	0x14002d990
IsPalette	4291	0x14003cdd4
IsUIAutomationProviderEnabled	4292	0x140028a90
MultiByteToUnicode	4293	0x140038068
NotifyAccessibilityEvent	4294	0x14003b42c
PreprocessBuffer	4295	0x140036154
ProcessAlphaBitmapI	4296	0x14002ea74
PurgeThemeHandles	4297	0x140034538
RegisterAllControls	4298	0x14003850c
RegisterBaseControls	4299	0x14003b7ac
RegisterBrowserControls	4300	0x14002eb80
RegisterCommonControls	4301	0x1400329b0
RegisterExtendedControls	4302	0x14003e07c
RegisterMacroControls	4303	0x140011df0
RegisterMiscControls	4304	0x14003d690
RegisterPVLBehaviorFactory	4305	0x1400143e4
RegisterStandardControls	4306	0x140024250
RegisterXControls	4307	0x14002bf1c
SetDefAction	4308	0x14002170c
SetDesktopDPIOverride	4309	0x14000668c
SkipDLLUnloadInitChecks	4310	0x1400247a8
StartMessagePump	4311	0x140024860
StopMessagePump	4312	0x140020ffc
StrToID	4313	0x14002b110
UiaHideOnGetObject	4314	0x1400167e0
UiaOnDestroySink	4315	0x1400113dc
UiaOnGetObject	4316	0x14001b200
UiaOnToolTip	4317	0x140034ac0
UnInitProcessPriv	4318	0x140007d60
UnInitThread	4319	0x140001560
UnicodeToMultiByte	4320	0x14002c2cc

Version Infos

Description	Data
LegalCopyright	Microsoft Corporation. All rights reserv
InternalName	bitsp
FileVersion	7.5.7600.16385 (win7_rtm.090713-
CompanyName	Microsoft Corporati
ProductName	Microsoft Windows Operating S
ProductVersion	6.1.7600
FileDescription	Background Intellig
OriginalFilename	kbdy
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2021 22:16:06.059156895 CEST	61805	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:16:06.080071926 CEST	53	61805	8.8.8.8	192.168.2.5
Sep 28, 2021 22:16:22.940155983 CEST	54795	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:16:22.973967075 CEST	53	54795	8.8.8.8	192.168.2.5
Sep 28, 2021 22:16:37.961474895 CEST	49557	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:16:37.991220951 CEST	53	49557	8.8.8.8	192.168.2.5
Sep 28, 2021 22:17:02.513978958 CEST	61733	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:17:02.548945904 CEST	53	61733	8.8.8.8	192.168.2.5
Sep 28, 2021 22:17:13.930501938 CEST	65447	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:17:13.936254978 CEST	52441	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:17:13.950078011 CEST	53	65447	8.8.8.8	192.168.2.5
Sep 28, 2021 22:17:13.965919018 CEST	53	52441	8.8.8.8	192.168.2.5
Sep 28, 2021 22:17:19.651493073 CEST	62176	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:17:19.674150944 CEST	53	62176	8.8.8.8	192.168.2.5
Sep 28, 2021 22:17:54.869443893 CEST	59596	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:17:54.889164925 CEST	53	59596	8.8.8.8	192.168.2.5
Sep 28, 2021 22:17:56.284233093 CEST	65296	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:17:56.303935051 CEST	53	65296	8.8.8.8	192.168.2.5
Sep 28, 2021 22:18:36.865396976 CEST	63183	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:18:36.885128975 CEST	53	63183	8.8.8.8	192.168.2.5
Sep 28, 2021 22:18:37.286889076 CEST	60151	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:18:37.306265116 CEST	53	60151	8.8.8.8	192.168.2.5
Sep 28, 2021 22:18:38.024810076 CEST	56969	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:18:38.044702053 CEST	53	56969	8.8.8.8	192.168.2.5
Sep 28, 2021 22:18:38.337071896 CEST	55161	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:18:38.357651949 CEST	53	55161	8.8.8.8	192.168.2.5
Sep 28, 2021 22:18:38.755683899 CEST	54757	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:18:38.773081064 CEST	53	54757	8.8.8.8	192.168.2.5
Sep 28, 2021 22:18:39.557554960 CEST	49992	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:18:39.576852083 CEST	53	49992	8.8.8.8	192.168.2.5
Sep 28, 2021 22:18:39.912374020 CEST	60075	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:18:39.929883957 CEST	53	60075	8.8.8.8	192.168.2.5
Sep 28, 2021 22:18:40.392385006 CEST	55016	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:18:40.411912918 CEST	53	55016	8.8.8.8	192.168.2.5
Sep 28, 2021 22:18:40.972650051 CEST	64345	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:18:40.991812944 CEST	53	64345	8.8.8.8	192.168.2.5
Sep 28, 2021 22:18:41.318427086 CEST	57128	53	192.168.2.5	8.8.8.8
Sep 28, 2021 22:18:41.337630033 CEST	53	57128	8.8.8.8	192.168.2.5

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll64.exe PID: 5360 Parent PID: 5352

General

Start time:	22:16:09
Start date:	28/09/2021
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe 'C:\Users\user\Desktop\2qTIaOLW2o.dll'
Imagebase:	0x7ff616e00000
File size:	1136128 bytes
MD5 hash:	E0CC9D126C39A9D2FA1CAD5027EBBD18
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 5532 Parent PID: 5360

General

Start time:	22:16:10
Start date:	28/09/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\2qTIaOLW2o.dll',#1
Imagebase:	0x7ff7eef80000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5612 Parent PID: 5532

General

Start time:	22:16:10
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe 'C:\Users\user\Desktop\2qTIaOLW2o.dll',#1
Imagebase:	0x7ff657810000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000002.00000002.322869708.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 240 Parent PID: 5360

General

Start time:	22:16:11
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\2qTIaOLW2o.dll,??0?$PatternProvider@VExpandCollapseProvider@DirectUI@@UIExpandCollapseProvider@@$00@DirectUI@@QEAA@XZ
Imagebase:	0x7ff657810000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000004.00000002.245204685.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 3472 Parent PID: 5612

General

Start time:	22:16:12
Start date:	28/09/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff693d90000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2920 Parent PID: 5360

General

Start time:	22:16:14
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\2qTIaOLW2o.dll,??0?$PatternProvider@VGridItemProvider@DirectUI@@UIGridItemProvider@@$01@DirectUI@@QEAA@XZ
Imagebase:	0x7ff797770000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000008.00000002.253887228.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5156 Parent PID: 5360

General

Start time:	22:16:18
Start date:	28/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\2qTIaOLW2o.dll,??0?$PatternProvider@VGridProvider@DirectUI@@UIGridProvider@@$02@DirectUI@@QEAA@XZ
Imagebase:	0x7ff657810000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000009.00000002.261001867.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: SndVol.exe PID: 2540 Parent PID: 3472

General

Start time:	22:16:50
Start date:	28/09/2021
Path:	C:\Windows\System32\SndVol.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SndVol.exe
Imagebase:	0x7ff65a090000
File size:	259904 bytes
MD5 hash:	CDD7C7DF2D0859AC3F4088423D11BD08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: SndVol.exe PID: 4928 Parent PID: 3472

General

Start time:	22:16:51
Start date:	28/09/2021
Path:	C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\cAlXLQGkN\SndVol.exe
Imagebase:	0x7ff6153d0000
File size:	259904 bytes
MD5 hash:	CDD7C7DF2D0859AC3F4088423D11BD08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000016.00000002.352259211.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: tabcal.exe PID: 1488 Parent PID: 3472

General

Start time:	22:17:03
Start date:	28/09/2021
Path:	C:\Windows\System32\tabcal.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\tabcal.exe
Imagebase:	0x7ff7522b0000
File size:	82944 bytes
MD5 hash:	F04F239BA5FED275E652372222D1BE00
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: tabcal.exe PID: 6012 Parent PID: 3472

General

Start time:	22:17:03
Start date:	28/09/2021
Path:	C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\CsJaRZ\tabcal.exe
Imagebase:	0x7ff6fb150000
File size:	82944 bytes
MD5 hash:	F04F239BA5FED275E652372222D1BE00
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000018.00000002.379949090.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: ProximityUxHost.exe PID: 4660 Parent PID: 3472

General

Start time:	22:17:16
Start date:	28/09/2021
Path:	C:\Windows\System32\ProximityUxHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\ProximityUxHost.exe
Imagebase:	0x7ff7c6a70000
File size:	264480 bytes
MD5 hash:	E7F0E9B3779E54CD271959C600A2A531
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: ProximityUxHost.exe PID: 1692 Parent PID: 3472

General

Start time:	22:17:20
Start date:	28/09/2021
Path:	C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\rPj\ProximityUxHost.exe
Imagebase:	0x7ff6a5690000
File size:	264480 bytes
MD5 hash:	E7F0E9B3779E54CD271959C600A2A531
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 0000001C.00000002.412511294.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: msinfo32.exe PID: 3060 Parent PID: 3472

General

Start time:	22:17:33
Start date:	28/09/2021
Path:	C:\Windows\System32\msinfo32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msinfo32.exe
Imagebase:	0x7ff6e1410000
File size:	370176 bytes
MD5 hash:	C471C6B06F47EA1C66E5FAA8DFCEF108
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: msinfo32.exe PID: 2616 Parent PID: 3472

General

Start time:	22:17:33
Start date:	28/09/2021
Path:	C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\52smNq1W\msinfo32.exe
Imagebase:	0x7ff7b2450000
File size:	370176 bytes
MD5 hash:	C471C6B06F47EA1C66E5FAA8DFCEF108
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000021.00000002.441901323.0000000140001000.00000020.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: dpapimig.exe PID: 5972 Parent PID: 3472

General

Start time:	22:17:45
Start date:	28/09/2021
Path:	C:\Windows\System32\dpapimig.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dpapimig.exe
Imagebase:	0x7ff758cd0000
File size:	76800 bytes
MD5 hash:	EE7DB7B615B48D8F9F08FAE70CAF46D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: dpapimig.exe PID: 4628 Parent PID: 3472

General

Start time:	22:17:50
Start date:	28/09/2021
Path:	C:\Users\user\AppData\Local\famGrLP\dpapimig.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\famGrLP\dpapimig.exe
Imagebase:	0x7ff6882c0000
File size:	76800 bytes
MD5 hash:	EE7DB7B615B48D8F9F08FAE70CAF46D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000023.00000002.478548185.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: dpapimig.exe PID: 3104 Parent PID: 3472

General

Start time:	22:18:02
Start date:	28/09/2021
Path:	C:\Windows\System32\dpapimig.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dpapimig.exe
Imagebase:	0x7ff758cd0000
File size:	76800 bytes
MD5 hash:	EE7DB7B615B48D8F9F08FAE70CAF46D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: dpapimig.exe PID: 1576 Parent PID: 3472

General

Start time:	22:18:05
Start date:	28/09/2021
Path:	C:\Users\user\AppData\Local\y7FgRNmA\dpapimig.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\y7FgRNmA\dpapimig.exe
Imagebase:	0x7ff675100000
File size:	76800 bytes
MD5 hash:	EE7DB7B615B48D8F9F08FAE70CAF46D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000026.00000002.511156934.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: SystemPropertiesPerformance.exe PID: 5336 Parent PID: 3472

General

Start time:	22:18:17
Start date:	28/09/2021
Path:	C:\Windows\System32\SystemPropertiesPerformance.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SystemPropertiesPerformance.exe
Imagebase:	0x7ff7d0cd0000
File size:	83968 bytes
MD5 hash:	F325976CDC0F7E9C680B51B35D24D23A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: SystemPropertiesPerformance.exe PID: 612 Parent PID: 3472

General

Start time:	22:18:18
Start date:	28/09/2021
Path:	C:\Users\user\AppData\Local\hbyq\SystemPropertiesPerformance.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\hbyq\SystemPropertiesPerformance.exe
Imagebase:	0x7ff605250000
File size:	83968 bytes
MD5 hash:	F325976CDC0F7E9C680B51B35D24D23A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_2, Description: Yara detected Dridex unpacked file, Source: 00000028.00000002.536952423.0000000140001000.00000020.00020000.sdmp, Author: Joe Security

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll64.exe PID: 5360 Parent PID: 5352 loaddll64.exeCOMMON

Executed Functions

Function 00000001400495B0, Relevance: 8.7, APIs: 2, Strings: 2, Instructions: 1727COMMON

Download Yara Rule

Strings

}*, xrefs: 0000000140049BDD
}*, xrefs: 0000000140049620

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: b2d8981d994e193b974dd97b3248349f041180fa9e1ee75c24f96b4e32672199
Instruction ID: dfe71950bb4b00d773a2c1e4d7d9ca62016f185058a51a46645e99606ce0912a
Opcode Fuzzy Hash: b2d8981d994e193b974dd97b3248349f041180fa9e1ee75c24f96b4e32672199
Instruction Fuzzy Hash: CDF2E476601B8481EB269F17D5503EE77A1F78EBC8F9A4025EB0A077B5DB38C945C348

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140036F30, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE ref: 000000014003704B
EntryPoint.2QTIAOLW2O ref: 00000001400370EE

Strings

)8GV, xrefs: 0000000140037008
d, xrefs: 0000000140037032

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ConsoleEntryFreePoint
String ID: )8GV$d
API String ID: 3550414006-3589632123
Opcode ID: 5ec560d6a9a6974c37ce79dd080152c0e94557a9349e5676412f3dbe41f5333a
Instruction ID: d510f836e5bc92855b025e221ee4853bd72dbb3d22a76ed0b2795177c136f2ac
Opcode Fuzzy Hash: 5ec560d6a9a6974c37ce79dd080152c0e94557a9349e5676412f3dbe41f5333a
Instruction Fuzzy Hash: 2C91983230064096EB26EB66D0513EE23A5AB9C7D4F914526BB1E47BFBEE34CA05C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005C340, Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 886COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE ref: 000000014005D101

Strings

sy;, xrefs: 000000014005C420
sy;, xrefs: 000000014005C9ED

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InfoSystem
String ID: sy;$sy;
API String ID: 31276548-3660992706
Opcode ID: 4ba7a1a776c1b2a8194e3aee1005776fcb25fed3b21deabde970c8a1fedf5655
Instruction ID: 6e6b9d6b41ba510f9365bd6ae70f9dc3139515c8db1fe8c3f4a6c85962f57752
Opcode Fuzzy Hash: 4ba7a1a776c1b2a8194e3aee1005776fcb25fed3b21deabde970c8a1fedf5655
Instruction Fuzzy Hash: 2A82DB72215B848AEB26CF27D4507E977E1F789BC4F498426EB4A077B6DB39C941C380

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004BD40, Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 789COMMON

Download Yara Rule

Strings

}*, xrefs: 000000014004BDB0
}*, xrefs: 000000014004C37C

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: 7295418c03dacbe62c915b6dd4b980e4d41f822c5e8600d002afc3f8743a909a
Instruction ID: 589d9863290c94d963c78ae1aba4b537ce1e649f887b860e334c2c2edf70769e
Opcode Fuzzy Hash: 7295418c03dacbe62c915b6dd4b980e4d41f822c5e8600d002afc3f8743a909a
Instruction Fuzzy Hash: B872E172211B8081EBA68F23D4547ED77A1F78DBC4F8A5125EB4A477B6EB38C944C348

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D290, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 000000014005D2ED

Strings

., xrefs: 000000014005D36A

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindFirst
String ID: .
API String ID: 1974802433-248832578
Opcode ID: 676bd74008c321f1f054d2561c231ee4757c1d63a5241c01311e4a1111e2dca9
Instruction ID: 4bac0f1caae8588fed560e2f4dd75fe3b4005a9d196e6938d52e54566134f4c2
Opcode Fuzzy Hash: 676bd74008c321f1f054d2561c231ee4757c1d63a5241c01311e4a1111e2dca9
Instruction Fuzzy Hash: C841A43260564085FB76DB26E1003AD73A1A748BF8F184713EF69177E9DB7AC982C742

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140026CC0, Relevance: 2.9, Strings: 2, Instructions: 362COMMON

Download Yara Rule

Strings

)8GV, xrefs: 0000000140027120
)8GV, xrefs: 000000014002703B

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: )8GV$)8GV
API String ID: 0-993736920
Opcode ID: 18572c4469c4a0c41f437429f188ca45752acbffb66c99d5f4ae5ffffdff8e8d
Instruction ID: e7db99c2ed76c24e9271fdfca30502f9120cd4f12b6678b2f47d4e41cadbe873
Opcode Fuzzy Hash: 18572c4469c4a0c41f437429f188ca45752acbffb66c99d5f4ae5ffffdff8e8d
Instruction Fuzzy Hash: 3BF18F7272064095EB52EB72D8913EE6365FB993C8F900426BB0E47AFADF34CA45C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006A4B0, Relevance: 1.7, APIs: 1, Instructions: 237nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 000000014006A550

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: be7f33bcedc807c98732488078dcab961074d424f9979e36399c30d48a789e42
Instruction ID: ba306794fc56961ae9be9e8108b60f4a03202e28571258f9feaa1cffdeadac3d
Opcode Fuzzy Hash: be7f33bcedc807c98732488078dcab961074d424f9979e36399c30d48a789e42
Instruction Fuzzy Hash: 25B16E36601B409AE712EF26D9403EE33A6F7497C8F645825EB4E47BA6DF38D524CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140048AC0, Relevance: 1.7, APIs: 1, Instructions: 185libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL ref: 0000000140048CDE

Part of subcall function 000000014005D1F0: FindNextFileW.KERNELBASE(?,?,CD3BEB56,0000000140048BFE), ref: 000000014005D21B

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindLoadNext
String ID:
API String ID: 50669962-0
Opcode ID: fc17d02b858c3dac1648e037cb345d4fc7c21cc3cb16b883a5b453f7ed5adb7b
Instruction ID: 5bbbb247b64301f03cc62f5655f26b2922a91791dd430743fbd3ba68f8766a4f
Opcode Fuzzy Hash: fc17d02b858c3dac1648e037cb345d4fc7c21cc3cb16b883a5b453f7ed5adb7b
Instruction Fuzzy Hash: 07819D3261568092FB22EB26E4513EE6365FBD83D4F814521FB4A57AEBEF38C605C704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140035270, Relevance: 1.7, APIs: 1, Instructions: 181COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140046C90: NtClose.NTDLL ref: 0000000140046CBE

ExitProcess.KERNEL32 ref: 00000001400354E1

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseExitProcess
String ID:
API String ID: 3487036407-0
Opcode ID: f61c91fb0970e67c6a79fc6014a4b8135498fcc788f1c9c4da93a6b1cc7f2ee4
Instruction ID: 3d479053040576d7404e3dfab4813d6254088c9544e20b556efee73ce8d776a8
Opcode Fuzzy Hash: f61c91fb0970e67c6a79fc6014a4b8135498fcc788f1c9c4da93a6b1cc7f2ee4
Instruction Fuzzy Hash: 5771BF32710A5096FB16EB72D4513EE2365AB883D9F844522BF5E53AFADF35C906C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046C90, Relevance: 1.5, APIs: 1, Instructions: 19nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL ref: 0000000140046CBE

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: daec19cacdd098f1244212ea8e14a5d3e1bd9439d57025bc9e494c2d8b520846
Instruction ID: acc9ee73913d888b71121e4cedfe861758cf19cabea33dd7822bbf7d3cf7603a
Opcode Fuzzy Hash: daec19cacdd098f1244212ea8e14a5d3e1bd9439d57025bc9e494c2d8b520846
Instruction Fuzzy Hash: 42E08CA1741A0041EF265276D0803A812809B4D7B4E194B209A7D0B3E0EA3888898716

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400524B0, Relevance: .8, Instructions: 815COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1fe821b06c1a4823bb9271ec043e796f757224c870123343ecb03a76390b80a
Instruction ID: bccbce3911ab829ef3288d496869760cb1404da12fac801df191153d1e38d36e
Opcode Fuzzy Hash: b1fe821b06c1a4823bb9271ec043e796f757224c870123343ecb03a76390b80a
Instruction Fuzzy Hash: 9172CD72601B9485FB26CF17D4503E967A1FB8EFC4F998426EB0A077A5EB39C945C380

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140065B80, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef59d8dad7016460516c65c54e0757d465c5ab080b3c9532efa0d5a42b826e15
Instruction ID: 84a8ec628d281786b49b5e6f6f6dec0d0376b1c45e732984354cafa0c8984479
Opcode Fuzzy Hash: ef59d8dad7016460516c65c54e0757d465c5ab080b3c9532efa0d5a42b826e15
Instruction Fuzzy Hash: D761947121164102FE76B72399047EE5292AFAD3E4F650B21BF6E47BF9EE38C9018740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140034870, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0ef0209839ca8ca4471a3cf5d0276b950f1549fe0a7092d1e0c7c3047baea22
Instruction ID: 713527809b35fed6260ebd230ad48717dd4fa7a304d79e310e96a8de0daf9cee
Opcode Fuzzy Hash: b0ef0209839ca8ca4471a3cf5d0276b950f1549fe0a7092d1e0c7c3047baea22
Instruction Fuzzy Hash: 5A717D32B04B4095FB12EBB2E4913DF67A5FBC8388F954025BB4957AAADF38D445CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140061360, Relevance: 6.3, APIs: 4, Instructions: 290registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 0000000140061459
RegEnumKeyW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 00000001400614B4
RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002), ref: 0000000140061539
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,80000002,?), ref: 0000000140061664

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close$EnumOpen
String ID:
API String ID: 138425441-0
Opcode ID: 6d358993c7a1d18b84dd2cf0468128b90f9fdacee2464d7bc44c5d41654a032b
Instruction ID: 4377045c35190c944746a6ea10b9b47c13ce871b5e3b3a15cce40fdff127085f
Opcode Fuzzy Hash: 6d358993c7a1d18b84dd2cf0468128b90f9fdacee2464d7bc44c5d41654a032b
Instruction Fuzzy Hash: 5BC1A43120568082FE629B16E8503EEA791E7C97E0F6C4A21FB6E47BE5DE78C941C740

Uniqueness

Uniqueness Score: -1.00%

Function 000001AF1AB62252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001AF1AB623B0
VirtualProtect.KERNELBASE ref: 000001AF1AB62471
RtlAvlRemoveNode.NTDLL ref: 000001AF1AB625B4
VirtualProtect.KERNELBASE ref: 000001AF1AB62677

Memory Dump Source

Source File: 00000000.00000002.267072052.000001AF1AB60000.00000040.00000001.sdmp, Offset: 000001AF1AB60000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: a9e1f660279ca61a8e2a57dc35c6dd3671c0891541b182fbb7d3810c56534afc
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 5EB15676619BC486D730CB5AE4807DEB7A0F7C9B80F50802ADE8D57B58DB79C8468F40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005F9F0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 000000014005FA4B

Strings

4aX, xrefs: 000000014005FA09

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DescriptorSecurity$ConvertString
String ID: 4aX
API String ID: 3907675253-4042356595
Opcode ID: b520f66aefeba3193101dc45b128e24964006f3aca92874ec0b7831a2dead927
Instruction ID: 5c7b4eddd96f597e19123db416744eb931adcf52cf9da5c093af566d74744993
Opcode Fuzzy Hash: b520f66aefeba3193101dc45b128e24964006f3aca92874ec0b7831a2dead927
Instruction Fuzzy Hash: EC216D72214B4582EA12EF66E1403DEB3A0FB8C7C4F844525EB8D07B6AEF39D625C745

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DAE0, Relevance: 3.1, APIs: 2, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f660e190c73e7b4003948b431d6e7d567b8cbbf6efc56bdf0b946b5d003fc2
Instruction ID: c5574eec75406f68cf122a08b4571db932f63f1e1c7d3e43579234279b4bb767
Opcode Fuzzy Hash: f5f660e190c73e7b4003948b431d6e7d567b8cbbf6efc56bdf0b946b5d003fc2
Instruction Fuzzy Hash: A151D03130464182FA72EA63A4507EA77A2BB8CBD4F154527BF5A077E2EF7AC801C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DD30, Relevance: 3.1, APIs: 2, Instructions: 122fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 000000014005DDD8
ReadFile.KERNELBASE ref: 000000014005DE49

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 00f6d0f3771a8cfa98223a140d65de6735ec101d3a44d5ddd75e2d9def7749f0
Instruction ID: 869152f87e2051f324d9e8f0f01270def7d2743b76a8e6c9a5e95a296a3a7e26
Opcode Fuzzy Hash: 00f6d0f3771a8cfa98223a140d65de6735ec101d3a44d5ddd75e2d9def7749f0
Instruction Fuzzy Hash: A541583161464087EA62DB3AA4447AAB3A1FBD87E0F144712BB6D4B7F5DF39C802DB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBB9, Relevance: 3.1, APIs: 2, Instructions: 79filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: 8a0a731fb1e22280383dc4c244850d697ffee92b9dbadae0b2290ba2595e9be9
Instruction ID: 944ab0cbe82d54181631abf043b2a82f72de4fdca767e43f24bb2c72b9c0c91f
Opcode Fuzzy Hash: 8a0a731fb1e22280383dc4c244850d697ffee92b9dbadae0b2290ba2595e9be9
Instruction Fuzzy Hash: 8D21B431214A4581EA72DB66A0407EA3795F78CBE4F184617EFAE077E5DF7AC806C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBD2, Relevance: 3.1, APIs: 2, Instructions: 77filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: d6d835041d1b41abb3b5fe648f8f275da576c4891ed88a603463ed8b7f508fb5
Instruction ID: bee1728ae0ee1a0caa625709e376bb4aadd3217f15d1bcce0d190476addee932
Opcode Fuzzy Hash: d6d835041d1b41abb3b5fe648f8f275da576c4891ed88a603463ed8b7f508fb5
Instruction Fuzzy Hash: BE21D332311A4581EA72DA66A0407EA3795B78CBE4F184527AF9D077E5DE7AC806C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBE8, Relevance: 3.1, APIs: 2, Instructions: 76filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: 6bbc7cb38f56b555cae5d46dc9eb85d7f0e424b0d62445df59964c24eed4e9f3
Instruction ID: a00dbcca095f64b26cda9c271166364bdf2e86a9b80154192fb139b54d898421
Opcode Fuzzy Hash: 6bbc7cb38f56b555cae5d46dc9eb85d7f0e424b0d62445df59964c24eed4e9f3
Instruction Fuzzy Hash: 5521E532315A4581EA72DB62A0407EE3791F78CBE4F184517AFAD077E5DE7AC806C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140060D10, Relevance: 3.1, APIs: 2, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,000000014004890D), ref: 0000000140060D85
RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,000000014004890D), ref: 0000000140060DE8

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0af55b123fcd85ad11f65efe4d0ac2719b06ecdcd8a99680970ae4064010c44f
Instruction ID: 09cc4365fb23fa9fe14c599ab373ea3e5ec1bde103bfdbf39ccb6e9a9538c2db
Opcode Fuzzy Hash: 0af55b123fcd85ad11f65efe4d0ac2719b06ecdcd8a99680970ae4064010c44f
Instruction Fuzzy Hash: F521A37671569046EF52CB56E8003AFA391EB897F4F184621BF9C07BE8EA38D582C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005DBF8, Relevance: 3.1, APIs: 2, Instructions: 73filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DC5C
SetFileTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001,?,000000014005DF81), ref: 000000014005DCE2

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: eb6f16229e65501cd5258548e2b4ff06530ad065b40e2a3bf9e2a9b945b11f61
Instruction ID: 68fcab11a3bde380270331896f94efb0ab36e54eb9d04e7f46ecdc112822b6b1
Opcode Fuzzy Hash: eb6f16229e65501cd5258548e2b4ff06530ad065b40e2a3bf9e2a9b945b11f61
Instruction Fuzzy Hash: 6821C132315A4541EA72DB62A0407EA3795F78CBE4F184627EFAD077E5DE7AC806C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046F60, Relevance: 1.7, APIs: 1, Instructions: 216COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32 ref: 0000000140046FDE

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: a83557768d75b00a6686b8b2e6e1d48d447f535bd9a920dc2f5e53c205635b4b
Instruction ID: 560481d37deeb2f3cc02cd101c0a384bc9ca8e36dca6fa428839860d024f360c
Opcode Fuzzy Hash: a83557768d75b00a6686b8b2e6e1d48d447f535bd9a920dc2f5e53c205635b4b
Instruction Fuzzy Hash: EDA15D3271064099EB12EFB6C4913EE2365A7987C8F915126BF0D67AFAEF34C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005FDA0, Relevance: 1.6, APIs: 1, Instructions: 144synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNELBASE ref: 000000014005FEFE

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 6be956e981540fc735b56164f72d0aea79e48331418f8fd9eaab398243b5d8cf
Instruction ID: 2cd33cf12082532a652157af79f02d7873b375395221c82c38bac87e111ef697
Opcode Fuzzy Hash: 6be956e981540fc735b56164f72d0aea79e48331418f8fd9eaab398243b5d8cf
Instruction Fuzzy Hash: 6E51B2326117408AEB66EB22A0013EE6291EB9DBC4F580535FF4E477E6DF39C802D790

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D1F0, Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,?,CD3BEB56,0000000140048BFE), ref: 000000014005D21B

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: ff4ac6c2ef48f38791092f6d6c449714fc18167456ec2ef2bc1084d7df7feef3
Instruction ID: fe48dd106ee2d63de4642147a978de6f9e341aec22c75ad1205c2678dbe1ece1
Opcode Fuzzy Hash: ff4ac6c2ef48f38791092f6d6c449714fc18167456ec2ef2bc1084d7df7feef3
Instruction Fuzzy Hash: 80115B7561034082FF76DA6691047E933E1EB697C8F051013EF59472E9EB36C8D2C751

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140060BA0, Relevance: 1.5, APIs: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32 ref: 0000000140060C16

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: a3c12b60ccc1d223e9782810bc36042d204e1f874336debb41352ff4bff3a234
Instruction ID: 650aff04d41c3b1619de3e88208a4500c6b85af191ab70c767efd2679610bbe3
Opcode Fuzzy Hash: a3c12b60ccc1d223e9782810bc36042d204e1f874336debb41352ff4bff3a234
Instruction Fuzzy Hash: 1C112E72204B8486D7219F12E84039EB7A5F788B90FA89529EB8D43B58DF39D991CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046690, Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

RtlCreateHeap.NTDLL ref: 00000001400466DD

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 21b05e3ef22cad88cebd019d8e45e363c17e6ba0707ecabdd33f955b9f4b15ed
Instruction ID: 54976bf3431427af6da968cf6b263ec8d4a99ac7c2bea2f2fd5649cd882baac1
Opcode Fuzzy Hash: 21b05e3ef22cad88cebd019d8e45e363c17e6ba0707ecabdd33f955b9f4b15ed
Instruction Fuzzy Hash: B901D635706A8082EB528712FA4039A73A0F78C3C4F198524EF884B7A5EF38C8518B44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140046730, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

RtlDeleteBoundaryDescriptor.NTDLL ref: 000000014004678C

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: BoundaryDeleteDescriptor
String ID:
API String ID: 3203483114-0
Opcode ID: 7b0e43f28c4f526d6edd5220e1ccf75e5ddb2081b4342278c18d43c75b4d1ee9
Instruction ID: 7e2fcedd46cf55f04110c2a11ced308778be976df41b62f125aabd7639a18320
Opcode Fuzzy Hash: 7b0e43f28c4f526d6edd5220e1ccf75e5ddb2081b4342278c18d43c75b4d1ee9
Instruction Fuzzy Hash: 70F0F878A4730141FE6A63B354543A511821FCC7C4F0E8834AF095B7A6EE38CD518699

Uniqueness

Uniqueness Score: -1.00%

Function 000001AF1AB62057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001AF1AB629A8), ref: 000001AF1AB620A7

Memory Dump Source

Source File: 00000000.00000002.267072052.000001AF1AB60000.00000040.00000001.sdmp, Offset: 000001AF1AB60000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 92deeec33e967ba7d614682390fd9b2333e5c756aeaf806d84a5d76df315091c
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: B3314A72715B8086D780DF1AE49479A7BA0F389BC4F609026EF8D87B18DF3AC446CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000000014002B6E0, Relevance: 8.2, Strings: 6, Instructions: 741COMMON

Download Yara Rule

Strings

GNOP, xrefs: 000000014002B9CB
0020, xrefs: 000000014002B98B
4040, xrefs: 000000014002BB6A
3050, xrefs: 000000014002BB42
3050, xrefs: 000000014002B992
0020, xrefs: 000000014002BB49

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: 0020$0020$3050$3050$4040$GNOP
API String ID: 0-829999343
Opcode ID: 44228da8cac31d2dc0c70f0cdabe69332272ec855145facb89f8ab4fe31cb411
Instruction ID: 282167bc52f218920562f67345f8403ae15435ff558287d674a5e0b6e797f698
Opcode Fuzzy Hash: 44228da8cac31d2dc0c70f0cdabe69332272ec855145facb89f8ab4fe31cb411
Instruction Fuzzy Hash: 4172507261068195EB22EF26D8913EE6365FB983C8F804016FB4E475FAEF34CA45C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140071DC0, Relevance: 5.7, Strings: 4, Instructions: 682COMMON

Download Yara Rule

Strings

ERCP, xrefs: 0000000140071EED
VUUU, xrefs: 000000014007211B
VUUU, xrefs: 0000000140072194
VUUU, xrefs: 000000014007213B

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU
API String ID: 0-2165971703
Opcode ID: 203c99bb3d64071a34d91be2023c6ff0f734778017a54347eb9ef20583df3fc0
Instruction ID: a95f611128f1d5d13a9bca75b656ea52fec65ffdb08565925219bb8e60db198b
Opcode Fuzzy Hash: 203c99bb3d64071a34d91be2023c6ff0f734778017a54347eb9ef20583df3fc0
Instruction Fuzzy Hash: 2252BE727046848AEB6A8F6AD5503ED7BA1F3087D8F144116FF569BAE8D73CC981C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400667D0, Relevance: 5.4, Strings: 4, Instructions: 448COMMON

Download Yara Rule

Strings

SW, xrefs: 0000000140066A69
SW, xrefs: 0000000140066C49
SW, xrefs: 0000000140066CA6
SW, xrefs: 0000000140066A1A

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: SW$SW$SW$SW
API String ID: 0-1120820918
Opcode ID: 504fdc64e4277b5cdd7e0fbd7d87dd69f88d92379ffb19f66d435a43d2ba4053
Instruction ID: 5271b3b9b35d550c8de01999338ba1aa790ab169e66fccb1d44a6718ff6f2241
Opcode Fuzzy Hash: 504fdc64e4277b5cdd7e0fbd7d87dd69f88d92379ffb19f66d435a43d2ba4053
Instruction Fuzzy Hash: 4C026D3170160146EB62EB73D8603EE2396AB9C3C8F554925BB4D87BEAEF35DA01C310

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140031DF0, Relevance: 5.3, Strings: 4, Instructions: 270COMMON

Download Yara Rule

Strings

GC,, xrefs: 00000001400321D7
GC,, xrefs: 0000000140031FC2
GC,, xrefs: 000000014003216C
GC,, xrefs: 0000000140032008

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: GC,$GC,$GC,$GC,
API String ID: 0-2774350030
Opcode ID: f1f9f4ebac57d756128b9510a0ada08cca09fc2c5e981d691c0745a1ff098da7
Instruction ID: dd0ba4053c6bdb050c0e262549aa376da4335980b2dde8bb0cc8774c9fa84b1c
Opcode Fuzzy Hash: f1f9f4ebac57d756128b9510a0ada08cca09fc2c5e981d691c0745a1ff098da7
Instruction Fuzzy Hash: 39B14A3232168096EA16EB22D4513EFA765FBDC7C4F854425FB4E57ABAEE38C605C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140057950, Relevance: 4.5, Strings: 2, Instructions: 1977COMMON

Download Yara Rule

Strings

}*, xrefs: 00000001400579C0
}*, xrefs: 0000000140057F89

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: }*$}*
API String ID: 0-2047341001
Opcode ID: e6c690fdf86b72ad9d28199ea77b3138ec3a0484b31e3533226b330c0e57f234
Instruction ID: 7c281f25cbc51a2c663274e483e0a5d4adc9f9b548fde4e06667abda5a9e2262
Opcode Fuzzy Hash: e6c690fdf86b72ad9d28199ea77b3138ec3a0484b31e3533226b330c0e57f234
Instruction Fuzzy Hash: 6E03CB72201B8482EB26CF23D4543ED67A1F78DBC4F994416EF4A177A6EB3AC945C380

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400263C0, Relevance: 4.3, Strings: 3, Instructions: 519COMMON

Download Yara Rule

Strings

@, xrefs: 0000000140026B3F
)8GV, xrefs: 00000001400267B0
)8GV, xrefs: 0000000140026A4D

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: )8GV$)8GV$@
API String ID: 0-2802744955
Opcode ID: 57ee0993af9c0e549763f7a53a352518d176ce6eec74434f4962690a020faea8
Instruction ID: d4403fa2ef2757ed15b0d897a8d3d48ae9d82dee7601a7ae60b507309942f45e
Opcode Fuzzy Hash: 57ee0993af9c0e549763f7a53a352518d176ce6eec74434f4962690a020faea8
Instruction Fuzzy Hash: 8F326E72610A8095FB22EB72D8513EE6365FB997C8F940026BB4E476FADF34CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400067B0, Relevance: 4.2, Strings: 3, Instructions: 406COMMON

Download Yara Rule

Strings

POST, xrefs: 0000000140006CF6
GET, xrefs: 000000014000688D, 000000014000689B
*/*, xrefs: 0000000140006D02

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: */*$GET$POST
API String ID: 0-3233530491
Opcode ID: de00d824490194d4ab20ecd241d123592732c947067d2b61cd25ef2c472af61f
Instruction ID: 6cf15a5ed41f927c804a0d4041fd2741414eb33ceb6b5d93e391305a3a4948eb
Opcode Fuzzy Hash: de00d824490194d4ab20ecd241d123592732c947067d2b61cd25ef2c472af61f
Instruction Fuzzy Hash: 57125C72610A8196EB11EF72E8913DE6765F7883D8F904122FB4E57AAADF34C249C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140035520, Relevance: 3.9, Strings: 3, Instructions: 117COMMON

Download Yara Rule

Strings

GC,, xrefs: 0000000140035665
GC,, xrefs: 0000000140035622
{QN, xrefs: 00000001400355E1

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: GC,$GC,${QN
API String ID: 0-3150587038
Opcode ID: fd0f7604477b89c46016288274ae5da6e1d22dae5e6d5d6e9033f3dbe6d447d0
Instruction ID: 9244b60d004d0bd22f383007071d62e4da67c70af0efad37e4d475a9577969ab
Opcode Fuzzy Hash: fd0f7604477b89c46016288274ae5da6e1d22dae5e6d5d6e9033f3dbe6d447d0
Instruction Fuzzy Hash: D851B3726017408AEB26AF72A0517DF3392EB98398F559529FB4E0BBE9DF39C401C741

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140025DB0, Relevance: 2.9, Strings: 2, Instructions: 401COMMON

Download Yara Rule

Strings

GC,, xrefs: 0000000140025E65
0, xrefs: 0000000140025FF4

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: 0$GC,
API String ID: 0-3557465234
Opcode ID: 666bbe70a71d3c2c69398fa3d4293e156315b44e2ec60054ed199f516d69305b
Instruction ID: 8e8f5bced65d739128878f1be46f709eb140c798bd495bd8ba2efbba04664ca7
Opcode Fuzzy Hash: 666bbe70a71d3c2c69398fa3d4293e156315b44e2ec60054ed199f516d69305b
Instruction Fuzzy Hash: 90F1C132705B8086EB56DB26A5503EE77A5F788BC8F544029FF8A47BA9DF38C845C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002FB20, Relevance: 2.7, Strings: 2, Instructions: 200COMMON

Download Yara Rule

Strings

cLpS, xrefs: 000000014002FB46
cLpS, xrefs: 000000014002FB76

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: cLpS$cLpS
API String ID: 0-581437482
Opcode ID: a74b94d121f69a53c48b7412ea4592a3fa94057a901d73d2553d715212f3bd98
Instruction ID: d6b56411a1e340b191dd7f08d0c8a8920ca136b0ade9766ce73097337fe28e3c
Opcode Fuzzy Hash: a74b94d121f69a53c48b7412ea4592a3fa94057a901d73d2553d715212f3bd98
Instruction Fuzzy Hash: F5916E32700A41A6FB12EB72D5513ED2366AB983D8F900126BF1D97AFADF34D919D340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140039140, Relevance: 2.1, Strings: 1, Instructions: 866COMMON

Download Yara Rule

Strings

D, xrefs: 0000000140039B2B

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 625a4165569e5cda328a69adeee0d2889436ced5db45894a9fc25686a6663ea2
Instruction ID: a2166a60d7ca2b4a0d1872d5e3506bb785f107662951e93f9f6f62b20c08bf0e
Opcode Fuzzy Hash: 625a4165569e5cda328a69adeee0d2889436ced5db45894a9fc25686a6663ea2
Instruction Fuzzy Hash: 32827E3222468186EB13EB26D4907EF6365FBD8794F904612FB5A47AFADF38C605C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000C5C0, Relevance: 2.1, Strings: 1, Instructions: 865COMMON

Download Yara Rule

Strings

GET, xrefs: 000000014000C5D5

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: GET
API String ID: 0-1805413626
Opcode ID: ad90eff7e429074c3171d1d7750f22c717ea2b99211725ab0fada14398ea0eeb
Instruction ID: e67aa13565bd515be4758c424d677281e7e48e69fdea67d752e56d6b70eb8f16
Opcode Fuzzy Hash: ad90eff7e429074c3171d1d7750f22c717ea2b99211725ab0fada14398ea0eeb
Instruction Fuzzy Hash: 7182CFB262568082FB52EB26E491BEE6761F7C97C8F851022FB4A576E7CF38C505C701

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140015120, Relevance: 2.1, APIs: 1, Instructions: 555COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32 ref: 000000014001530B

Part of subcall function 0000000140046C90: NtClose.NTDLL ref: 0000000140046CBE

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseEnvironmentExpandStrings
String ID:
API String ID: 1839112984-0
Opcode ID: c9d53a0457a1cd09ce33f0e44b0c1efeb6a94f7f7900f232ca9e877f73a21e84
Instruction ID: c0dbe0ee55e83fb6c0f3bef3624a57e5635b4c6ed11a4d6c977be8f15ec7e338
Opcode Fuzzy Hash: c9d53a0457a1cd09ce33f0e44b0c1efeb6a94f7f7900f232ca9e877f73a21e84
Instruction Fuzzy Hash: CB427E32710A4096FB12EB72D4913EE6765EB983D8F814422BB4D4BAFAEF34C645C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140019D20, Relevance: 2.0, APIs: 1, Instructions: 546COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 264e6395d79e5c951bb00c579c7dbb3dbd2549077176e85cc9e0eaa9f71e9daa
Instruction ID: abc698a25be580435ac5d46bd6b01b3c7dd535f90f9c32282677b8a643a0cbd6
Opcode Fuzzy Hash: 264e6395d79e5c951bb00c579c7dbb3dbd2549077176e85cc9e0eaa9f71e9daa
Instruction Fuzzy Hash: 3C427D3271068095FB22EB76D8513EE2361EB993C8F904121BB0E5BAFAEF79C545C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140019580, Relevance: 2.0, APIs: 1, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b968e64abe9abd3a3de4733753983f1fc81c42df08cba27ac083e4bca772e0d5
Instruction ID: 0bcce83d19b55e388762cc41cc2fbdfa61478623d1bee2f25155124e52c32027
Opcode Fuzzy Hash: b968e64abe9abd3a3de4733753983f1fc81c42df08cba27ac083e4bca772e0d5
Instruction Fuzzy Hash: 8A128E3271468095FB22EB72D8913EE2355EB997C4F804026BB4E5BAFADF35C605C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006EB0, Relevance: 1.9, Strings: 1, Instructions: 651COMMON

Download Yara Rule

Strings

cLpS, xrefs: 00000001400072A3

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: cLpS
API String ID: 0-2886372077
Opcode ID: 2e67248885d3231caee68ad477ef8dbb0fc58746848a3e53b47d22ee52dc9e10
Instruction ID: 96b4c198141fe6e7034ab14ad9d5ea3cda72442e6a1109ae0a48173783152c86
Opcode Fuzzy Hash: 2e67248885d3231caee68ad477ef8dbb0fc58746848a3e53b47d22ee52dc9e10
Instruction Fuzzy Hash: CF528D7272464092FA12EB62E8517EE63A5FB9C7C4F814022BB4E57BBADF38C505C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400139D0, Relevance: 1.8, Strings: 1, Instructions: 571COMMON

Download Yara Rule

Strings

m, xrefs: 000000014001422E

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateMutex
String ID: m
API String ID: 1964310414-3775001192
Opcode ID: c9374d3b1b70a0b5016d4bfa609cf52c2576d31e59d18b3d6c96c49798d7a1d3
Instruction ID: 0a9d90af75a6ede7406656d6adb6787827cf479cbe6b14872f7c626c13ea0b6d
Opcode Fuzzy Hash: c9374d3b1b70a0b5016d4bfa609cf52c2576d31e59d18b3d6c96c49798d7a1d3
Instruction Fuzzy Hash: 6A529B32710A80A6F74EEB32C5913EE7369F788384F904026AB2947AE6DF34D576C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001D100, Relevance: 1.7, Strings: 1, Instructions: 497COMMON

Download Yara Rule

Strings

s( j, xrefs: 000000014001D128

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: s( j
API String ID: 0-1450404818
Opcode ID: 54e4b798d34b45faf103682024a9517c9dbab2a4bc4f3be1384f05470f761d53
Instruction ID: 6f5b3d0b06e06ce3defbe5b62ba999e8dce43b7996f1ec96da6707378b1ebcba
Opcode Fuzzy Hash: 54e4b798d34b45faf103682024a9517c9dbab2a4bc4f3be1384f05470f761d53
Instruction Fuzzy Hash: 14325632715B9085EB16EF66D8513ED73A5FB88B88F454026EB4E5BBAADF38C505C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140029780, Relevance: 1.7, Strings: 1, Instructions: 491COMMON

Download Yara Rule

Strings

kw9b, xrefs: 000000014002989A

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseEnumValue
String ID: kw9b
API String ID: 858281747-837114885
Opcode ID: 02ea5fdd771505a99f68015f3d50b243f34d981a4f95777f339d56f7d1ecbc93
Instruction ID: a79da12e532d7eb86b4034213f2927d281404f76e1d3d8be4d202bd2a10f559e
Opcode Fuzzy Hash: 02ea5fdd771505a99f68015f3d50b243f34d981a4f95777f339d56f7d1ecbc93
Instruction Fuzzy Hash: D622A03270064056FB22EB62E4513EE6361EB8C7D8F814625BB4E57AFADF38CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140033BB0, Relevance: 1.7, Strings: 1, Instructions: 454COMMON

Download Yara Rule

Strings

U, xrefs: 000000014003408F

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 3a4a69faf180f69004b33dda68d362ed2bbf7b3fd2da1c832a56e2b1ab5ff4c9
Instruction ID: 04dcf981b535b3d5a04f4e0f983876b723d65533687fb2a3abc72c4897885b35
Opcode Fuzzy Hash: 3a4a69faf180f69004b33dda68d362ed2bbf7b3fd2da1c832a56e2b1ab5ff4c9
Instruction Fuzzy Hash: 7A22A032714A8095FB22EB76D4913EE2761EB993D4F900122BB4E5BAFADF38C545C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023530, Relevance: 1.7, Strings: 1, Instructions: 430COMMON

Download Yara Rule

Strings

Content-Type, xrefs: 000000014002385F

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: Content-Type
API String ID: 0-2058190213
Opcode ID: a72386b5604f31efd12f8b14e9def473356216e6e74e8d7582f8a5eae0caee9d
Instruction ID: 8ed0294b40edec3e111ebf6e63eddced9ff886ac8d86313f53d4d34ac86a637b
Opcode Fuzzy Hash: a72386b5604f31efd12f8b14e9def473356216e6e74e8d7582f8a5eae0caee9d
Instruction Fuzzy Hash: D0128B7271064096EB26EB72D0953EE63A5EB9D7C8F804029FB4E576B6DF34C909C341

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400389A0, Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

0, xrefs: 0000000140038A46

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID: 0
API String ID: 3535843008-4108050209
Opcode ID: 8ddd15f8411ae99665c6d832388cc8a987df6c74cb7f6332accfe98739e7c6a3
Instruction ID: 021d52728ad99ff4b45c00a2ee63d530dbb35c35c3e7b67721d4418a9cae59c0
Opcode Fuzzy Hash: 8ddd15f8411ae99665c6d832388cc8a987df6c74cb7f6332accfe98739e7c6a3
Instruction Fuzzy Hash: A4D1483271064185EB22EB66D8503EF6365FB987C8F944421FF4E57AAAEF34CA05C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400205A0, Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

, xrefs: 000000014002069B

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4776ee01d56c33aec5e48eff476734f2fa4515d5fa9e40d042db1bb470cbc6b6
Instruction ID: 091f4e73938a5afec608f70625f4eed5baac112ec883e15b973b01c59944fd94
Opcode Fuzzy Hash: 4776ee01d56c33aec5e48eff476734f2fa4515d5fa9e40d042db1bb470cbc6b6
Instruction Fuzzy Hash: 8FB1903271164156FB26EB72C0513EE2365A78C7C8F554429BF0E67BEAEE34D906C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002EED0, Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

, xrefs: 000000014002F04E

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: afcdf8bb0e357bfe6aef15eeae53d7d14d31b7b3b81c27b41d3473f744a31e09
Instruction ID: 79bcb73a3e0a748e54816e3c2b9a8955141e4b7d1d3c260807ef7fd3e9233e09
Opcode Fuzzy Hash: afcdf8bb0e357bfe6aef15eeae53d7d14d31b7b3b81c27b41d3473f744a31e09
Instruction Fuzzy Hash: 4681AF3171528042FA66AB63A5513EE6382BBDC7C0F954839BF0E57BEADE38C9019750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023140, Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

tI*k, xrefs: 0000000140023300

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: tI*k
API String ID: 0-257501792
Opcode ID: f04d9850251323a46599d6d4d621c288aa743e3308fe79e758d55af8e8fde22c
Instruction ID: 2b3e36108f388e75195695150bf3b7502d87346db4925aa772ee75e92517338c
Opcode Fuzzy Hash: f04d9850251323a46599d6d4d621c288aa743e3308fe79e758d55af8e8fde22c
Instruction Fuzzy Hash: C891B332710A41C6FB12EB73D4913ED2365AB987C8F815026BF0E67AABDE34C605C391

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140078570, Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

ERCP, xrefs: 00000001400785BF

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: ERCP
API String ID: 0-1384759551
Opcode ID: 9a8959bd3d8286152fe3b07e5e9b9c99826fd1463cb640f02497020a3b8cf481
Instruction ID: 36d71a898891e4cfc692b0c24b63e4f8a605753b41eb4ec31f3d0d909baacb04
Opcode Fuzzy Hash: 9a8959bd3d8286152fe3b07e5e9b9c99826fd1463cb640f02497020a3b8cf481
Instruction Fuzzy Hash: 8541C2677244554AE3189F2598213BE2391F7E8781B008838BBC7C3B99E97CCE41C754

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004F940, Relevance: .9, Instructions: 873COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12ec76cf0be21c5f9df498b30f5ba0310eb789adaf758c2e9b0f70ec965ecdda
Instruction ID: fc2f62d5942ef41123ea32f2955be4f6aadf7052ab01c2248917173129c7cd0f
Opcode Fuzzy Hash: 12ec76cf0be21c5f9df498b30f5ba0310eb789adaf758c2e9b0f70ec965ecdda
Instruction Fuzzy Hash: 8A82BD72301B8486EB269F23D4503EE67A5F78DFC4F964022EB4A577A6DB38C945C384

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140053F20, Relevance: .8, Instructions: 808COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7250f98c0d712e4fed8a9177b7990c03dbf5da58cb0dd37bc7f0a46ed34db0c
Instruction ID: b1defcb4bfd3908c290bb80924a7f4486985742b072abc47c5e9bd5be53152ef
Opcode Fuzzy Hash: d7250f98c0d712e4fed8a9177b7990c03dbf5da58cb0dd37bc7f0a46ed34db0c
Instruction Fuzzy Hash: FF72CE32601BA482EB26CF17E4503ED77A5FB99BC8F9A4016EB49477B6DB36C941C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140054BA0, Relevance: .8, Instructions: 797COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6290f3f4936625c1500c9bb5ab49f73b0f0e92f6783c0cfd327242af27f29f
Instruction ID: 8249503d4e55669e8e7119aec1729776b7b2f3ca46fae70a891a003f6664f3d4
Opcode Fuzzy Hash: 0b6290f3f4936625c1500c9bb5ab49f73b0f0e92f6783c0cfd327242af27f29f
Instruction Fuzzy Hash: 3472DF32201B9486EB26DB17E4603ED77A5FB9DBC5F894012EB4A477B6DB3AC941C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140016E80, Relevance: .7, Instructions: 739COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 4d20719b00ba206c941d910dc95295eebd62a72d6182f88786a52ebef2786c96
Instruction ID: 4fdb0601fab6f7a848b28641239d596080eab1ec2c6ff824b21f12e2ef69b5a1
Opcode Fuzzy Hash: 4d20719b00ba206c941d910dc95295eebd62a72d6182f88786a52ebef2786c96
Instruction Fuzzy Hash: 48722D32724A4095EB02EB76D4913EE6765EB983C4FC05012BB4E879BBEF38C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004EB60, Relevance: .7, Instructions: 687COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5011eb9cb6aa6b6263c6f35743ff2c5b604e035348663584ee7cf6575c78c39
Instruction ID: d53d10191d1a85c044aba7f3ec212ac92ce5176a248edb2932ce54add84afe44
Opcode Fuzzy Hash: c5011eb9cb6aa6b6263c6f35743ff2c5b604e035348663584ee7cf6575c78c39
Instruction Fuzzy Hash: 9D52BE72601B8081EB269F23D4543EE77A1F78CBC4F8A5426EB4A577B6DB38D845C348

Uniqueness

Uniqueness Score: -1.00%

Function 000000014007BD50, Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1d6ac494662c45c571e96f77a6e8211c4f0b163f6c515dcb42af03e52a945a
Instruction ID: 9c06e88039ccf999e040ad7794a2e2d02b6699145a9792014979c24fd1337f6c
Opcode Fuzzy Hash: dd1d6ac494662c45c571e96f77a6e8211c4f0b163f6c515dcb42af03e52a945a
Instruction Fuzzy Hash: B4623CB76206548BD7668F26C080B6C37B1F35DFA8F25521ADF0A43799CB39D891CB90

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003B220, Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 910a0854ce61fb42f92242d67a9e79fffefb0a345c204043947c09dcbfd41573
Instruction ID: acd1ff4a64a9c803ec812a22a8ce79600e1464d52fdb42fb628072365476121f
Opcode Fuzzy Hash: 910a0854ce61fb42f92242d67a9e79fffefb0a345c204043947c09dcbfd41573
Instruction Fuzzy Hash: 64429E31301A8141FA23EB6698513EF6391EB8C7E8F544616BF5A5BBEAEE38C505C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140024440, Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 998b1ddceebd43e2263fee28e30734e9d0938ae8fa33c42ca310df4930d37c8e
Instruction ID: 78f3400fd7e206f6a511ea736ed45412fb3e7259efd4ed926287f6c9bd4c6aa7
Opcode Fuzzy Hash: 998b1ddceebd43e2263fee28e30734e9d0938ae8fa33c42ca310df4930d37c8e
Instruction Fuzzy Hash: E6427C32204A8096EB66EB32D0513EE67A4E79D3C8F914026F79A876F7DF38C945C741

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018630, Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33595a0ae7ae050496e2ab1d278563b3c2a5762d02515bf2bbbda731ac1c0ea0
Instruction ID: 8108868c1ca7c4f1afbe8bd34af9d7f1e96dfbbf12b1edd0cffad3fdf1fa0b6f
Opcode Fuzzy Hash: 33595a0ae7ae050496e2ab1d278563b3c2a5762d02515bf2bbbda731ac1c0ea0
Instruction Fuzzy Hash: 3F429E3231068095FB22EB72D8913EE6765EB983D8F844122BB0D97AFADF34C645C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023BF0, Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7780a59e1de69b0cf687f210dfc14c756bc1871688fd785b5760caf7f949748
Instruction ID: 183f2e46b23aa86a2c091461a645f9a581571388db0d92becfc597eb429af356
Opcode Fuzzy Hash: b7780a59e1de69b0cf687f210dfc14c756bc1871688fd785b5760caf7f949748
Instruction Fuzzy Hash: 0732AB3271064089EB16EB36D4513EE27A5EB8CBD8F555126FF0E877BADE38C4868340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400123C0, Relevance: .5, Instructions: 544COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aad0c81bd1ef663b3ca28dc3f930843d78cf9f34da4a601b61f6920fa07b0f06
Instruction ID: 71edd40f2b1ab928f6f3b4ddf8d26af45cb7d1258c95c78617a62a1a74f3288a
Opcode Fuzzy Hash: aad0c81bd1ef663b3ca28dc3f930843d78cf9f34da4a601b61f6920fa07b0f06
Instruction Fuzzy Hash: BF32AC3261068195EB12EB26D4913EE2765FB983C8F814122FB4E57AFBEF38C645C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B120, Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e936cb68d2b1b2eb177f9066c17e649f04a555929bf45c6c272ced2084c800
Instruction ID: 3ba19fba285517c5acd5c21b3c9b7592edaf423ca2de06bba8230fcf7af2400b
Opcode Fuzzy Hash: b3e936cb68d2b1b2eb177f9066c17e649f04a555929bf45c6c272ced2084c800
Instruction Fuzzy Hash: 3C429B72624A8095FB12EB62D4957EE2365FB983C8F814022FB0D57ABBDF34C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400381A0, Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ee38f4c6dee734349d5b0dcc202e437ae908f573234f4aff5f510a5883c84b0
Instruction ID: eb795f204498a8d956ef0de19ff8bd43d97085c04d8ed5933d3115b51340510f
Opcode Fuzzy Hash: 7ee38f4c6dee734349d5b0dcc202e437ae908f573234f4aff5f510a5883c84b0
Instruction Fuzzy Hash: 7022793270064186EA23EB2AD4957EF63A5EB88BD4F554626FF0A477F6EE34C506C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003A2E0, Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8d1907d2a62ce1ae108db488a351868ceb64fffc9dd42578434a0f34ae656a
Instruction ID: 697e8bd1027fccc09012cb901671f32632dfdae7722e2c733c5167ca59ce0a7a
Opcode Fuzzy Hash: 1e8d1907d2a62ce1ae108db488a351868ceb64fffc9dd42578434a0f34ae656a
Instruction Fuzzy Hash: AE227C3271064186EA23EB26D4513EF63A1FB89BD4F544625EB4A577F6EF38C50AC340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B390, Relevance: .5, Instructions: 458COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b3dc1032e7b852d429d3288fc6d56ff3ef19d98c02d1d103b4f123b92fc1f1
Instruction ID: 5c003effdee5129b35cf12aebe167f862a01b0c8d0d2f43ab9f1123e32a30f31
Opcode Fuzzy Hash: 71b3dc1032e7b852d429d3288fc6d56ff3ef19d98c02d1d103b4f123b92fc1f1
Instruction Fuzzy Hash: 8C0203B21082A489F7768B26C9413FA7BE2E759788F254906FB8A435F5D738C9C1D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000DDF0, Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb205b7a6ee905cc09960fce77ad47978854b70030ed005f0890884a870a1a32
Instruction ID: c2c66f55aa66479377f68c186b881699d763759fa92e2ffabb716b860ed1a50b
Opcode Fuzzy Hash: bb205b7a6ee905cc09960fce77ad47978854b70030ed005f0890884a870a1a32
Instruction Fuzzy Hash: CD224D72710A8091EB12EB72D4913EE6765FB987C8F904116FB4E876BAEF38C245C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005C40, Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15df393565114496b883043814055486ccf344906c194c3ce1e07dcd13d946b9
Instruction ID: 217fabc6e38e1d640ccd999207fddb20e056db183073941d35cbdb4b11e649c3
Opcode Fuzzy Hash: 15df393565114496b883043814055486ccf344906c194c3ce1e07dcd13d946b9
Instruction Fuzzy Hash: 10229B72620A8091EB12EB62E4957EE2365F79D7C4F814022FB4E576BBDF38C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140067A40, Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea887a778da0c4d823fc531a90df8c56e0fea0844e8c08b73ff5c051f2067ac5
Instruction ID: 3448a1cfdf5732c1482eebf940cb1862e5db89764351cf67f11e8459266109f6
Opcode Fuzzy Hash: ea887a778da0c4d823fc531a90df8c56e0fea0844e8c08b73ff5c051f2067ac5
Instruction Fuzzy Hash: CD026C727006418AEB12DF26D4907EE73A6F788BC4F614525EB0E977AADF34D90AC740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000BB40, Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d26cf2a233f346bafc191a7485f238315b0ad988856bb6f3df34a704e7161a3
Instruction ID: a963730c34943060851cd64ea719675db259de8104656558a9074d2de6a51302
Opcode Fuzzy Hash: 1d26cf2a233f346bafc191a7485f238315b0ad988856bb6f3df34a704e7161a3
Instruction Fuzzy Hash: 41128F7222468096FB52EB22D4917EE6765FBD93C8F811022FB4E57AABDF38C505C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140069010, Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: 79375f47d623451fa7ae57ca2c8a354685be071432fa0e8bcc9ed6f72a1db439
Instruction ID: 5afa6d75f76fbbc9d7f53df6043056336d1db5d7591574d5123318d553f9c856
Opcode Fuzzy Hash: 79375f47d623451fa7ae57ca2c8a354685be071432fa0e8bcc9ed6f72a1db439
Instruction Fuzzy Hash: 19124E3272469096EB12EF72D8913DE6765FB987C8F815022BB0D57AABDF34C605C710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001E170, Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: cc215cb0727d0f62d43bc96d126eaa9914981bc77efcde216c4a9579e5f00e4b
Instruction ID: ac8bef764291a5126b18a53dad73757551fec454a5992e6944e07fe4b855ac86
Opcode Fuzzy Hash: cc215cb0727d0f62d43bc96d126eaa9914981bc77efcde216c4a9579e5f00e4b
Instruction Fuzzy Hash: 2A023B32724A80A2FB52EB72D4913EE6764FB983C4F815022BB4D57AEADF35C545C710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002FEC0, Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3d21d4258e3a29319f9a96101cd2f21149d882cfd022cce79424961b0ee497
Instruction ID: b67327a95b15ec145a913cc43aeca3e3a8a77925bd43874970612b3ea802a6ff
Opcode Fuzzy Hash: ef3d21d4258e3a29319f9a96101cd2f21149d882cfd022cce79424961b0ee497
Instruction Fuzzy Hash: A802707272064095EB02EB66D4913EE6765FB987C8F905022FB4D83ABBEF34C649C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002980, Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 864ff842a0553a758e8954151dc8c584767613b96f8a8b8cb95920c7dbaa340a
Instruction ID: 5d574d698b33f004de0812fa71b34c36bbdae31478704d480fb686f148b39898
Opcode Fuzzy Hash: 864ff842a0553a758e8954151dc8c584767613b96f8a8b8cb95920c7dbaa340a
Instruction Fuzzy Hash: EB024C72324A8096FB12EB62D4913EE6765EB983D4FC15022BB4E57AEBDF34C605C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018F80, Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3becc9593f8dc16cc0bf83216b62256b3bf4fa3205e19b4f6712f3e75d9ea019
Instruction ID: d38a929efe70148cd0bcafb05e8c0916e90d43f0c382b2c9e415ecaf47ade149
Opcode Fuzzy Hash: 3becc9593f8dc16cc0bf83216b62256b3bf4fa3205e19b4f6712f3e75d9ea019
Instruction Fuzzy Hash: C8F16D32610A8095FB12EB76D8513EE6365EB983D8F940521BB0E57AFBEF35C605C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140010880, Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4b03ee28a6f9c3dcc190bafc517853f672639143c120c5c05d4b85a3d99092b
Instruction ID: f0fb79f68922493fed5bc905321703954c20a875d362dace52344ff7232635a8
Opcode Fuzzy Hash: f4b03ee28a6f9c3dcc190bafc517853f672639143c120c5c05d4b85a3d99092b
Instruction Fuzzy Hash: D7029272320AA19AEB42DF36C8917EE2724F748789F805016FF4B57AAAEF35C545C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001D910, Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: 584cd532a5689d97deaa5d07457d1b4e21756204e2966b7d65b3e9048de79881
Instruction ID: 9c3e8f75c9e591130820bb2956cb3806339feb13e112d9af22726fcddd3bd126
Opcode Fuzzy Hash: 584cd532a5689d97deaa5d07457d1b4e21756204e2966b7d65b3e9048de79881
Instruction Fuzzy Hash: 12026C32314A8095FB52EB72D4917EE2765EB983C4F805022BB4E97AEBDF35C649C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140033540, Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 604e2370054c2ba176b600820b34f66f10e1ea8059e515df92688ea971a13995
Instruction ID: d0d419901b6e3c3183ee3913f1137c5e588d0fadc92f77f7791849e6aeb29d3b
Opcode Fuzzy Hash: 604e2370054c2ba176b600820b34f66f10e1ea8059e515df92688ea971a13995
Instruction Fuzzy Hash: 8A029132614A8095EB22EF32D4913EE6765FB98388F904412FB4E57AFADF34C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140017B40, Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f836b13ca52ed182dd4fa63defd2b0ea21b4d3e0954b26b359ea7fc1e310f7d
Instruction ID: fccd9241a873054b7c24d42fb58abb6f012b2f7f19fe3a4c061a127f88627f2a
Opcode Fuzzy Hash: 6f836b13ca52ed182dd4fa63defd2b0ea21b4d3e0954b26b359ea7fc1e310f7d
Instruction Fuzzy Hash: 41E18E3271068095FB12EB76D8917EE6765EB983C8F804021BB0D5BAEBEF35C645C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002CB80, Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0cf63d0b519ed5d97f22363695d36c5222c83b5d1ad00431571b901e6fca07a
Instruction ID: 02ee9b89192d395c78975687d30e6fb06be8b995001c736011e159ca0d17724c
Opcode Fuzzy Hash: f0cf63d0b519ed5d97f22363695d36c5222c83b5d1ad00431571b901e6fca07a
Instruction Fuzzy Hash: E2E13D32714A4095EB02EB66D4913EE6765FB983D8F900012FB4D97AFAEF34CA49C750

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400018D0, Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29781ba53559d3dc50cf0f2f15a84a7cf4628c2ebccdacb10c6fcecc24b84b9f
Instruction ID: 95da75048f27146dafc5de9d612871b80806eb61125b8034b1f63b71f4cba504
Opcode Fuzzy Hash: 29781ba53559d3dc50cf0f2f15a84a7cf4628c2ebccdacb10c6fcecc24b84b9f
Instruction Fuzzy Hash: 47F12C3262498096EB12EB62D8513ED6365FBD8388F814522BB4E479FBEF74CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003AAC0, Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbde258a7258c6dcea16206b586576d490218543a150ef902403ecebef91e157
Instruction ID: cf5fdc312f2229dc6ff813412d90ddbabd12b8e4de7574aebc9877f7d05b411a
Opcode Fuzzy Hash: fbde258a7258c6dcea16206b586576d490218543a150ef902403ecebef91e157
Instruction Fuzzy Hash: 28D19032711A4195EB12EB76D4903EE23A1EB993C4F844425BF4E57BEAEF38C605C350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140064080, Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16253b5d55ff71ace7e49d720cc951c571e11621ee8e21fa8c6a30ce5dfdcbdc
Instruction ID: bf23390ce128f79092fde7b2b9043ef6653a4f1b38eae35900255c6e9c132ad5
Opcode Fuzzy Hash: 16253b5d55ff71ace7e49d720cc951c571e11621ee8e21fa8c6a30ce5dfdcbdc
Instruction Fuzzy Hash: ABC1D4231282D04BD7569B3764503FAAE91E79A3C8F280655FFC997AEBD63CC2149B10

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002D0D0, Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b40e6eacf62e76be1b8b75bafda47ed8448d1fd03054a9369b8e8acea66f16
Instruction ID: d0d512be425b72175eef7d799d9923e381f6a995b1e0446f0295c878f1c0c086
Opcode Fuzzy Hash: b8b40e6eacf62e76be1b8b75bafda47ed8448d1fd03054a9369b8e8acea66f16
Instruction Fuzzy Hash: CED13972724A4091EB02EB76D4913EE6765F7983C8F904016BB4D97ABAEF38C605C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140030530, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b35f0d6758cd8f3e0fc5dd2d9b2fc08aa7627d825f96aef82561ee73172148e7
Instruction ID: 96955b53f7f5b4430e01eb0035ad3df088e7672fa3a311151148bede835f9000
Opcode Fuzzy Hash: b35f0d6758cd8f3e0fc5dd2d9b2fc08aa7627d825f96aef82561ee73172148e7
Instruction Fuzzy Hash: E7C16136B0564089FB22EB76D0613EF27A1AB9C388F554425BF4E976FADE34C506C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002A110, Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 686467ccd25c0df5bb2f5f586546a15faedf638fff92cd16c1235860dc25e2c1
Instruction ID: 08807915bc927436db1a901aa043915a979950c5e23cf508b5f0d65b77d78aa9
Opcode Fuzzy Hash: 686467ccd25c0df5bb2f5f586546a15faedf638fff92cd16c1235860dc25e2c1
Instruction Fuzzy Hash: 0CD17032614A8096EB02EB26D4513EE6364FBD97C4F815122FB4D57AEBDF38CA05C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005F490, Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c475dbfd977b16fce9b803e5c4d1a49df0c999b42866701d306626aed01fc7
Instruction ID: f96005f1b71c62cd91ec633b0fa556b6f093996ab6e40a041e3cbd638a23d0d9
Opcode Fuzzy Hash: 56c475dbfd977b16fce9b803e5c4d1a49df0c999b42866701d306626aed01fc7
Instruction Fuzzy Hash: C1C1BD3270164096FB12EF76D4413ED23A4EB883A8F484622BF2D57AE6EF38D955D350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022D00, Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e39bf3007a281af8f80b1ba370eb854d899cc1c697e4714c51e2032bd266e41
Instruction ID: 38de139323f3e079e5738bdd278af51575638bb101dd3218b17e6965c0953cb4
Opcode Fuzzy Hash: 0e39bf3007a281af8f80b1ba370eb854d899cc1c697e4714c51e2032bd266e41
Instruction Fuzzy Hash: 1DB16A3671062094FB46EBA2D8A17DE2365BB89BC8F825025FF0D67BA7DE38C505C354

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140031540, Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3fabecde598c45a64a6eedacbe428125337e4d2251bd2f359c5e7871d7e6cae
Instruction ID: bfe4e87f351d28bd3d3693bc96d2151355ab9388d993d4a46e39ffd0a3f78ad6
Opcode Fuzzy Hash: a3fabecde598c45a64a6eedacbe428125337e4d2251bd2f359c5e7871d7e6cae
Instruction Fuzzy Hash: E6C16332704A809AFB22EBB2D4513EE2365AB9C3D8F854521BF1E676EADF30C505C354

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140062B00, Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfd4a30f1a27aef1054c36b1d99c0610af0cc08103e55e4b01f0e7caa7c836f
Instruction ID: f23c3879964f3f83b961310f1bad7f7be1ef7afa2b68ec7d59790f469601a501
Opcode Fuzzy Hash: bcfd4a30f1a27aef1054c36b1d99c0610af0cc08103e55e4b01f0e7caa7c836f
Instruction Fuzzy Hash: A9A10231211E8145EBA79A2798543EF27A6AB8C3D4F645825FF0E5B6E9EF34C901C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B41B, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16274a22d167cb7459d5025cfc47ed7afc639167fa2c9c1057ca1fd72c03709f
Instruction ID: c0d98bc7e162404dc537a7c1af49e5fbe25e03b535df8b2493956c53732576b9
Opcode Fuzzy Hash: 16274a22d167cb7459d5025cfc47ed7afc639167fa2c9c1057ca1fd72c03709f
Instruction Fuzzy Hash: B2A114F31182A486FB778A2685413FA7FE2E719789F254402FB8A435F6C63CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140066020, Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 043f26720dd9e716372f03acbb0aed68245d4d24b07a7821003da1e91a5cddba
Instruction ID: d17e179c4ad3c1814a715198efb3da372d22ab0628f3c9d9f6a3a053a6971865
Opcode Fuzzy Hash: 043f26720dd9e716372f03acbb0aed68245d4d24b07a7821003da1e91a5cddba
Instruction Fuzzy Hash: 79A1903271164045EB22EB7298507EE67E6AB9C3C8F550925BF4D47BEAEF34CA068310

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007A60, Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d447cbcf228b9ee3d46bc9c2d717141a2b521ef67b2a83db3152711cb204db34
Instruction ID: 7cb660c1bafc6db3c15f0a4866a94b05aa7759728bb06ab0739d07cd917ce7e2
Opcode Fuzzy Hash: d447cbcf228b9ee3d46bc9c2d717141a2b521ef67b2a83db3152711cb204db34
Instruction Fuzzy Hash: 33B18C7262464191EB12EB62E4913EE6365FB9C7C4F801022FB4E47ABBDF38C649C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B43D, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8327572ae460ec67bee7642bc1df1dfc8e00bf19c98c3d2f0bb37742338d2b
Instruction ID: ff1b56ecf022c2229069a5389c0477a62f006b84fd5f9f69eebb894724ab9066
Opcode Fuzzy Hash: dc8327572ae460ec67bee7642bc1df1dfc8e00bf19c98c3d2f0bb37742338d2b
Instruction Fuzzy Hash: 44A125F21182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B424, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92fc6e297697f72d3d55b197ac04fe50775a4f95a26f4c9e919e5e137ab98750
Instruction ID: f965aa676d2cc64f6a485257af634002c7fef1377d4791c8bed9b1b7e56d6411
Opcode Fuzzy Hash: 92fc6e297697f72d3d55b197ac04fe50775a4f95a26f4c9e919e5e137ab98750
Instruction Fuzzy Hash: 79A115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B42D, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e075c1df208aa39fb877a834bfc4403f559291216783e55fb63477ae2eadfdc
Instruction ID: 86c182e730ead1fa639f737d8458d4edb1cdee6041daaa12aedc2aef895c7c0c
Opcode Fuzzy Hash: 1e075c1df208aa39fb877a834bfc4403f559291216783e55fb63477ae2eadfdc
Instruction Fuzzy Hash: 83A115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B436, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68406ce4345875cbc0110dbe212228596ffa7fd34d07f9d141f7f6a9cf54bfa
Instruction ID: 7a8579acbe1e06e5dcc528155c10978c06d1d02f61772b3afab02cdca005db6d
Opcode Fuzzy Hash: b68406ce4345875cbc0110dbe212228596ffa7fd34d07f9d141f7f6a9cf54bfa
Instruction Fuzzy Hash: 3EA115F31182A489FB778A2685413FA7FE2E719789F254402FB8A435F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006B446, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a2fa5d4e375044cfc16d96b5b502da69406d12098659286745a9d4aecf6a6c
Instruction ID: 9b5f4d2890da7bc9148b0c777fb781a5a0913674a9f0c1f21bc34f13756e8484
Opcode Fuzzy Hash: 20a2fa5d4e375044cfc16d96b5b502da69406d12098659286745a9d4aecf6a6c
Instruction Fuzzy Hash: 37A114F31182A489FB778A2685413FA7FE2E719789F254402FB8A475F6C23CC985D720

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140069A50, Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a45eda91708ab1aacb7bb8f3e4ce101a12129cf9cca7a03e3bdc867366dc72
Instruction ID: 9e8436de532ad8a8b9d83a7ce7f67d33a1e65f1b543d517c902b78be038a8119
Opcode Fuzzy Hash: 86a45eda91708ab1aacb7bb8f3e4ce101a12129cf9cca7a03e3bdc867366dc72
Instruction Fuzzy Hash: 6FA19F3271464095EB22EB72D4913EE63A5A78C7C8F914426FF0D57AFAEE38C609C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001010, Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b042d90c0f8c1feaf42d72467fc8ea1d5898c5b9afd74594c11dc23e78b13021
Instruction ID: 891caef274385c1d9a1a05b5f8e139ad0eea2bdcde326525a3acf11d5ee056db
Opcode Fuzzy Hash: b042d90c0f8c1feaf42d72467fc8ea1d5898c5b9afd74594c11dc23e78b13021
Instruction Fuzzy Hash: 79918D7270164095EB16EF66E4507EE23A5ABDC7C4F448425BF4E97BA6EE34C906C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002EA00, Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 512a32fa61db023d7c70a902f6f830f613e17a898db76ca3daa742f5f8256a0f
Instruction ID: 09ec91f3f7d35e473cfa3e72b303784d96220d522314983c3d838af10b8059fe
Opcode Fuzzy Hash: 512a32fa61db023d7c70a902f6f830f613e17a898db76ca3daa742f5f8256a0f
Instruction Fuzzy Hash: C4A16E32314A8095FB22EB72D8513EE2365EB987D4F940426BB4D57AFADF34CA05C710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018300, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88475fb2c6a6599ab4cc8279e16f30dd0b70266d660e7a26aadfe83eb0debd28
Instruction ID: 9282ef7f3f2e177ec3162a27807bc3d77d508fe5c2bed51c5ff564ba7b898efa
Opcode Fuzzy Hash: 88475fb2c6a6599ab4cc8279e16f30dd0b70266d660e7a26aadfe83eb0debd28
Instruction Fuzzy Hash: 99912232B15A4099FB12EBB2D4913ED23659B9C7C8F814525BF0DA76EBEE34C609C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002E1B0, Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: b01ab17e6f799bc842c5d88e197ae85b70910d75e452052a355b3acd4a6f1dd6
Instruction ID: a01e236db0e61280ae7bc249da652572acbbc64743681568c883ee8cb5c556df
Opcode Fuzzy Hash: b01ab17e6f799bc842c5d88e197ae85b70910d75e452052a355b3acd4a6f1dd6
Instruction Fuzzy Hash: D7916C3272468092FB12EB62D4957DE6365FB9C7C4F811022BB4D43AABDF78C544CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003EFB0, Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bec047f33ee0572188590f4278c6d3b9bee721e36306d1774188d0e8c9170a8
Instruction ID: 2085d5fbde7ab3b46fd7c59f247d5158c6ccb74e37f4a5dfc0e2ff2c0c09d730
Opcode Fuzzy Hash: 9bec047f33ee0572188590f4278c6d3b9bee721e36306d1774188d0e8c9170a8
Instruction Fuzzy Hash: 87814F36204A85C6EB679B2BE9403AF6B61F38DBD0F594512EF9A477B5CE38C442D310

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400276C0, Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acef9d6c792aa5ca49f2c29346a17435bbfaeb5850aa39e74b5b9c26e26a22ee
Instruction ID: bfac23c94d9038130fb0cc9f6c7292f6f1aa2b418e68c536fc9a693e481bc66c
Opcode Fuzzy Hash: acef9d6c792aa5ca49f2c29346a17435bbfaeb5850aa39e74b5b9c26e26a22ee
Instruction Fuzzy Hash: 1E91B13270164096FB22EB22D4517EE23A0EB9C3C8F855426BB4E57AFADF34C944C351

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140064E80, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bede4ae264e8185b0f9f24becd31f8195eff363a0612df846459a6d3a9af60c0
Instruction ID: 348a5c641c523964159132b8cb670365254cd557f13034448bd6fc243d7f1d42
Opcode Fuzzy Hash: bede4ae264e8185b0f9f24becd31f8195eff363a0612df846459a6d3a9af60c0
Instruction Fuzzy Hash: AB81503271064095FB12EB76D8913EE63A5AB9D7C8F944621BF0D4BAEAEF34C605C350

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140016100, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5f1541c9e731f93d217d80ea735c4fc72df752bf49aca760e28bc1eb456cbe
Instruction ID: 4362bffb4ce140633d60009826b42a117c21897de7dbf4a94b418fc321f1d931
Opcode Fuzzy Hash: 7e5f1541c9e731f93d217d80ea735c4fc72df752bf49aca760e28bc1eb456cbe
Instruction Fuzzy Hash: 35812032714A809AFB12EB72D4513ED2365EB9C388F814425BB4E67AEBEF35C605C354

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140032650, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 74d02335a182ac745f12b46122d9b514f038e14b56bae688da794cb2178cf5d1
Instruction ID: a8b049447ef23dc7a2f3147d56ae0c312f8ac6a7955db6ed7517384e00930876
Opcode Fuzzy Hash: 74d02335a182ac745f12b46122d9b514f038e14b56bae688da794cb2178cf5d1
Instruction Fuzzy Hash: 0371893270264096FB66AB7294503EE6391EB9C7C8F054526BB1D47BEAEF39C905C360

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400663F0, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d7b3c9e63ec17fbb3decf34851c1318d937a82485f1e960baa699eab580419
Instruction ID: 4c1290556f20f3e20b66d81894b0d385f6ea8bc2319cc982c81cb2944955426d
Opcode Fuzzy Hash: 53d7b3c9e63ec17fbb3decf34851c1318d937a82485f1e960baa699eab580419
Instruction Fuzzy Hash: 6E61B031301A4041EA66E737A9517EF97929F9D7D0FA44621BF5E877FAEE38C9028700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005D850, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77a108d01ed5e48e728334738bee74428d616c7e3897ce2e5c51364c5533d5f8
Instruction ID: 50d9e92313d7fbe24902196c924c1612cff9653e99501bbf2772a847790ebefc
Opcode Fuzzy Hash: 77a108d01ed5e48e728334738bee74428d616c7e3897ce2e5c51364c5533d5f8
Instruction Fuzzy Hash: 7D618D3271464496FB22EB72C0913EE23A5ABDC7C8F854422BF4D57AEAEE35C501C791

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001620, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d8748cd9258cc028bf8f61fbfc0b9e6566f23ab3e3e39526fa7d95fc661ede3
Instruction ID: f8f81a1e6eeb4aa67bd22a5a7a70358e1ddf5b3241a247c9d5674b6b5ab46101
Opcode Fuzzy Hash: 4d8748cd9258cc028bf8f61fbfc0b9e6566f23ab3e3e39526fa7d95fc661ede3
Instruction Fuzzy Hash: 9061C43262465091FB21EB26E0517EE6360FBCD7C4F815122BB5D47AEAEF79C541CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400319F0, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 76fd309855d3cb7fd7bce00cc76c58418989d2c5f3a40dfa08261f005ae71509
Instruction ID: f33abad4c1c8ba015261be05896130ca5dc3e7c07ce7e813c180037223ea8262
Opcode Fuzzy Hash: 76fd309855d3cb7fd7bce00cc76c58418989d2c5f3a40dfa08261f005ae71509
Instruction Fuzzy Hash: 08718E32714A809AEB12EF76D4913EE7761F798388F844026FB4D47AAADF74C548CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400688A0, Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$ClosePointerRead
String ID:
API String ID: 2610616218-0
Opcode ID: a2dba2a1a4eb368f1bfbcbfd8edb6338b687c99584bacbcabd6119f3cef53153
Instruction ID: 125c4d10a522e701d1fb6d0f1aef761f583aa31ccbb75f1db25899523a723602
Opcode Fuzzy Hash: a2dba2a1a4eb368f1bfbcbfd8edb6338b687c99584bacbcabd6119f3cef53153
Instruction Fuzzy Hash: 0151633271468052FB22EBB6E4513EE6761EBD83C4F951122BB4D47AEADE38C544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022730, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025899d978c00459a39b97666279dda4e96ed2cbcc4f77a24580eef4709ea6a8
Instruction ID: af2d80f9b144edbe9aa630ca6e788b257520dbedf888a3db325da96401233726
Opcode Fuzzy Hash: 025899d978c00459a39b97666279dda4e96ed2cbcc4f77a24580eef4709ea6a8
Instruction Fuzzy Hash: FA612832600B8085E755DF36A481BDD33A9F78DB88FA84138EF990B36ADF318055D768

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140031340, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1db513d4a09b2a69b061a10c471bba7e299da44f56f9c8592c8711ae3a5069cd
Instruction ID: 50cb9f747c07e87171e39f534f7bbd71060f83f950b2ada1a46c15cbddfc577a
Opcode Fuzzy Hash: 1db513d4a09b2a69b061a10c471bba7e299da44f56f9c8592c8711ae3a5069cd
Instruction Fuzzy Hash: A0511B32700A4096FB12EB76D4917EE2365AB9C7C8F954421BF0DA7AEADF34C605C350

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002F840, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1a38846fc5b12dd28166e38272f044d4b391af603d2f1471411a8db1635f5ab
Instruction ID: 9602d307e9de31d357e639a9611a18ab9b6f2b9e1d5f0c6a8a00986c6f50d329
Opcode Fuzzy Hash: e1a38846fc5b12dd28166e38272f044d4b391af603d2f1471411a8db1635f5ab
Instruction Fuzzy Hash: 7F51AD32200A40A2EA22EB22D9957FE63A5F7DC7D0F854626FB0D836B6DF34C556D710

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002DDE0, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 9fc9325c37c130981f2a6d163060b6ac96a18c10bccee10927051abba076a10f
Instruction ID: aca98edda921e0e11dbb2b437e66833b6d9475281c93859f86ded24665675a69
Opcode Fuzzy Hash: 9fc9325c37c130981f2a6d163060b6ac96a18c10bccee10927051abba076a10f
Instruction Fuzzy Hash: E5516E3271465095FB52EB76E4913EE6761EBD8388F850026BB4E479EADF38C948CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140060FE0, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ea3a40ed743baa62fec9aad1f49b986252dc4ca71b2a4a7cc5ab9f35980e68
Instruction ID: 51a026cb75a50cc44213724d5bb8c382370875f63e51d6fdf42d7c4c4c07ed92
Opcode Fuzzy Hash: 63ea3a40ed743baa62fec9aad1f49b986252dc4ca71b2a4a7cc5ab9f35980e68
Instruction Fuzzy Hash: 5D415F32B1066095FB12E77798517EE23A2ABCD7C4FA94421BF0E57AEBDE34C5018354

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400611A0, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edf4f86e66165465d87231c9be9cd45b6afd9b1fb44ae45836aa280f5e06574e
Instruction ID: fec891e6c53086f7b9094a78f95b73510c7007b912bc3ef8a41aa8e11e9acb14
Opcode Fuzzy Hash: edf4f86e66165465d87231c9be9cd45b6afd9b1fb44ae45836aa280f5e06574e
Instruction Fuzzy Hash: 01413D31B2066095FB12EB7798513EE13A6ABDC7C4F994421BF0E97AEADE38C5058314

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022A00, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a10d479a193238a188e8adb5c0a2baa624421bbad2986b298b06f84ca2b66ec
Instruction ID: 4d6ce7f696a26fe9a74b6bb9734e6d6bbac3d85ccec2ef1c97bdec5ab73240ea
Opcode Fuzzy Hash: 9a10d479a193238a188e8adb5c0a2baa624421bbad2986b298b06f84ca2b66ec
Instruction Fuzzy Hash: FC51D732610B9085E785DF36E4813DD33A9F748F88F58413AAB8D4B7AADF348152C764

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400286B0, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 0dd31b007056381f4657a5f1dbdce23ecbf955912ad383fd51e82bbfc18d9e36
Instruction ID: a9185cf0004c76bb3001b2cb896eaa84c5f9aff40342764b4326ba4d96cea24c
Opcode Fuzzy Hash: 0dd31b007056381f4657a5f1dbdce23ecbf955912ad383fd51e82bbfc18d9e36
Instruction Fuzzy Hash: 9F514632310B81A2E74EDB32E5813D9B369FB8C384F908415EB9813AA6DF35D676D704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022340, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0bc628afaa724f2a407568f7776cab89400c990b0d91b82c0bf42df1747497
Instruction ID: 1e1e8128ca37617077ad8d3bddb138d765a5f71e348f586f351b06e9a9582713
Opcode Fuzzy Hash: 8d0bc628afaa724f2a407568f7776cab89400c990b0d91b82c0bf42df1747497
Instruction Fuzzy Hash: 5C51C773611B9085E745DF36E8813DD37A8F748F88F58413AEB894B6AADF308156C760

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140063BD0, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a990b53e0665ad0886faa979631976ec8b00dc7985899795eb44eacb3e5b3434
Instruction ID: 5f416d68214368cc8d497caad67b5ad9eebcd67f96a0df70edf52f54e079c757
Opcode Fuzzy Hash: a990b53e0665ad0886faa979631976ec8b00dc7985899795eb44eacb3e5b3434
Instruction Fuzzy Hash: DE31F53221099842FBA6471B9C613F93292E79C3E4F649625FB8E537F4D67DC8038B80

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005370, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bce42950a1e8a62078921d64ca997753bf7c09f413ca20ce6f360246a445e94
Instruction ID: 604a730c127844f2816d2636316060c5dd02da03d6f4240a24423d76594c64fe
Opcode Fuzzy Hash: 5bce42950a1e8a62078921d64ca997753bf7c09f413ca20ce6f360246a445e94
Instruction Fuzzy Hash: 55313F32610B9091E749DB36D9813DD73A9F78CB84FA58526A39847AA6DF35C177C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007EA0, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.266558177.0000000140001000.00000020.00020000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.266538729.0000000140000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266736863.0000000140080000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.266783641.0000000140092000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.266809047.0000000140094000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc6e0ee29a39c7d5a8b9bac5d98e7e3adc62a080d0eb157144b98198d9367420
Instruction ID: 1d8fa33d8030516f9812c7435f1c2f5fee2e6c5a40d503ba1f82db291cb841dc
Opcode Fuzzy Hash: cc6e0ee29a39c7d5a8b9bac5d98e7e3adc62a080d0eb157144b98198d9367420
Instruction Fuzzy Hash: 7131DC32600B4080E745DF3699813EDB3E9FBACB88FA9853697484A9B6DF35C157D310

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 5612 Parent PID: 5532 rundll32.exeCOMMON

Executed Functions

Function 000001E9A1722252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001E9A17223B0
VirtualProtect.KERNELBASE ref: 000001E9A1722471
RtlAvlRemoveNode.NTDLL ref: 000001E9A17225B4
VirtualProtect.KERNELBASE ref: 000001E9A1722677

Memory Dump Source

Source File: 00000002.00000002.323358227.000001E9A1720000.00000040.00000001.sdmp, Offset: 000001E9A1720000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: f829b48fa17cdbbea4a1f9c788413bb31b19c3e8cffb417d34ece4b89beaccf0
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 2FB134B6619BC486D770CB1AE4407EEB7A1F7C9BC0F108126EE8957B58DB79C8528F40

Uniqueness

Uniqueness Score: -1.00%

Function 000001E9A1722057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001E9A17229A8), ref: 000001E9A17220A7

Memory Dump Source

Source File: 00000002.00000002.323358227.000001E9A1720000.00000040.00000001.sdmp, Offset: 000001E9A1720000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 2aaf1edd2ae32e42f563ab45ea56fbc772746ac8ccf4c5e5c1ee815a8ec03c37
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 67312BB6715B9086D790DF1AE45479A7BA0F789BD4F205026EF8D87B18DF3AC446CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 240 Parent PID: 5360 rundll32.exeCOMMON

Executed Functions

Function 000002019B662252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000002019B6623B0
VirtualProtect.KERNELBASE ref: 000002019B662471
RtlAvlRemoveNode.NTDLL ref: 000002019B6625B4
VirtualProtect.KERNELBASE ref: 000002019B662677

Memory Dump Source

Source File: 00000004.00000002.245369834.000002019B660000.00000040.00000001.sdmp, Offset: 000002019B660000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: 26acf094702049f8c39bbe646e2d66cee83499135d817360c5dca0b2f8992191
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 36B16476618BC886D730CB5AF490B9EB7A0F7C9B80F108026EEC957B59DB79C8518F40

Uniqueness

Uniqueness Score: -1.00%

Function 000002019B662057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000002019B6629A8), ref: 000002019B6620A7

Memory Dump Source

Source File: 00000004.00000002.245369834.000002019B660000.00000040.00000001.sdmp, Offset: 000002019B660000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: bc64fb082964568851e8e838f5772081c87f74d5965c419ca3b6f615b794a7b7
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 0C312976615B9486D790DF1AE49475A7BB0F389BD4F209026EF8D87B28DF3AC446CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 2920 Parent PID: 5360 rundll32.exeCOMMON

Executed Functions

Function 000001B137022252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 000001B1370223B0
VirtualProtect.KERNEL32 ref: 000001B137022471
RtlAvlRemoveNode.NTDLL ref: 000001B1370225B4
VirtualProtect.KERNEL32 ref: 000001B137022677

Memory Dump Source

Source File: 00000008.00000002.254268092.000001B137020000.00000040.00000001.sdmp, Offset: 000001B137020000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: c12f907c84206503550892b2fe5f0eac032b69bec395c005d07d0f487b6871e8
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 1CB163B7618BC486D730CB5AE440BDEB7A1F7C9B90F518026EE8953B68DB79C8418F40

Uniqueness

Uniqueness Score: -1.00%

Function 000001B137022057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,000001B1370229A8), ref: 000001B1370220A7

Memory Dump Source

Source File: 00000008.00000002.254268092.000001B137020000.00000040.00000001.sdmp, Offset: 000001B137020000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 85120477238c827c8f8ef2583784222d580ed5dd11447d48969501fe94542f00
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 5F315C72715B8086D780DF1AE45479A7BA1F389BD4F614026EF8D87B28DF3AC442CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 5156 Parent PID: 5360 rundll32.exeCOMMON

Executed Functions

Function 000001BB815D2252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 000001BB815D23B0
VirtualProtect.KERNELBASE ref: 000001BB815D2471
RtlAvlRemoveNode.NTDLL ref: 000001BB815D25B4
VirtualProtect.KERNELBASE ref: 000001BB815D2677

Memory Dump Source

Source File: 00000009.00000002.261552680.000001BB815D0000.00000040.00000001.sdmp, Offset: 000001BB815D0000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: d79d028022ea539f0a759290d18f0ae1a6bb17cac50e682879c89143ca8841b4
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: 0EB14276619BC486D770CB1AE480BDAB7A5F7C9B80F108026EE8D57B58DB7DC8518F40

Uniqueness

Uniqueness Score: -1.00%

Function 000001BB815D2057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,000001BB815D29A8), ref: 000001BB815D20A7

Memory Dump Source

Source File: 00000009.00000002.261552680.000001BB815D0000.00000040.00000001.sdmp, Offset: 000001BB815D0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: 983ba4086220490d9b69023a8ba16cb997c181ce3e93ec79c930a334639e3fe6
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 05313C72715B9086D790DF1AE49479A7BA4F389BD4F205026EF8D87B28DF7AC446CB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: SndVol.exe PID: 4928 Parent PID: 3472 SndVol.exeCOMMON

Executed Functions

Function 0000016CB91D2252, Relevance: 6.2, APIs: 4, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0000016CB91D23B0
VirtualProtect.KERNELBASE ref: 0000016CB91D2471
RtlAvlRemoveNode.NTDLL ref: 0000016CB91D25B4
VirtualProtect.KERNELBASE ref: 0000016CB91D2677

Memory Dump Source

Source File: 00000016.00000002.352575864.0000016CB91D0000.00000040.00000001.sdmp, Offset: 0000016CB91D0000, based on PE: true

Similarity

API ID: ProtectVirtual$NodeRemove
String ID:
API String ID: 3879549435-0
Opcode ID: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction ID: fc8f8f768b3fd091548868e8408c8727646c965675e68d64fa26bdad0e48a2c8
Opcode Fuzzy Hash: 75ec9f23c294f1b91f48f20b57dd5cc1f886561a981db544c7b3bcf3c6961842
Instruction Fuzzy Hash: A8B14576618BD486DB30CB1AE440BDEB7A0F7C9B80F148026DEC957B68CB7AC8518F40

Uniqueness

Uniqueness Score: -1.00%

Function 0000016CB91D2057, Relevance: 1.3, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,?,0000016CB91D29A8), ref: 0000016CB91D20A7

Memory Dump Source

Source File: 00000016.00000002.352575864.0000016CB91D0000.00000040.00000001.sdmp, Offset: 0000016CB91D0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction ID: a36df3ab57a9b9fa99bb699d4b9697e5b99fc06658f24bbe319f39737f81806c
Opcode Fuzzy Hash: e198c79539a4ed8551c2286ff6a3e0dfce1ca71c07a98c6b4ee2f43e3e4de89f
Instruction Fuzzy Hash: 17315E72615B9086D780DF1AE45579A7BA4F789BC4F208026EF8D87B28DF3AC442CB40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF6153D6218, Relevance: 75.7, APIs: 42, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

BufferedPaintInit.UXTHEME ref: 00007FF6153D6254
GetDlgItem.USER32 ref: 00007FF6153D6275
GetDlgItem.USER32 ref: 00007FF6153D6289
GetDlgItem.USER32 ref: 00007FF6153D62D7
SendMessageW.USER32 ref: 00007FF6153D62F2
SendMessageW.USER32 ref: 00007FF6153D6309
memset.MSVCRT ref: 00007FF6153D6318
GetDlgItem.USER32 ref: 00007FF6153D633B
GetClientRect.USER32 ref: 00007FF6153D6348
SendMessageW.USER32 ref: 00007FF6153D6381
SendMessageW.USER32 ref: 00007FF6153D6399
SendMessageW.USER32 ref: 00007FF6153D63C2
SendMessageW.USER32 ref: 00007FF6153D63D6
SendMessageW.USER32 ref: 00007FF6153D63F0
SendMessageW.USER32 ref: 00007FF6153D6404
GetWindowLongW.USER32 ref: 00007FF6153D641E
SetWindowLongW.USER32 ref: 00007FF6153D6430
GetDlgItem.USER32 ref: 00007FF6153D6443
GetDlgItem.USER32 ref: 00007FF6153D6486
ShowWindow.USER32 ref: 00007FF6153D6494
GetDlgItem.USER32 ref: 00007FF6153D64A1
GetDlgItem.USER32 ref: 00007FF6153D64AB
ShowWindow.USER32 ref: 00007FF6153D64B6
GetDlgItem.USER32 ref: 00007FF6153D64C3

Part of subcall function 00007FF6153D8A90: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6153D8AD2

ShowWindow.USER32 ref: 00007FF6153D64D1
GetClientRect.USER32 ref: 00007FF6153D64DE
MapWindowPoints.USER32 ref: 00007FF6153D64F5
DestroyWindow.USER32 ref: 00007FF6153D64FE
OpenThemeData.UXTHEME ref: 00007FF6153D6466

Part of subcall function 00007FF6153EEA14: malloc.MSVCRT(?,?,?,?,?,?,00000000,00007FF6153D45FD), ref: 00007FF6153EEA2E

SetWindowPos.USER32 ref: 00007FF6153D65D2
DestroyWindow.USER32 ref: 00007FF6153D65EA
GetDlgItem.USER32 ref: 00007FF6153D65FB
GetDlgItem.USER32 ref: 00007FF6153D6616
DestroyWindow.USER32 ref: 00007FF6153D661F
GetWindowRect.USER32 ref: 00007FF6153D6677

Part of subcall function 00007FF6153EEA14: _CxxThrowException.MSVCRT ref: 00007FF6153EEA55

GetDlgItem.USER32 ref: 00007FF6153D66CA
GetClientRect.USER32 ref: 00007FF6153D66DB
GetWindowRect.USER32 ref: 00007FF6153D66E8
MapWindowPoints.USER32 ref: 00007FF6153D66FD

Part of subcall function 00007FF6153E23BC: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000001,00007FF6153D5551), ref: 00007FF6153E23E0
Part of subcall function 00007FF6153E23BC: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000001,00007FF6153D5551), ref: 00007FF6153E2406

Part of subcall function 00007FF6153D528C: _CxxThrowException.MSVCRT ref: 00007FF6153D52A8

Part of subcall function 00007FF6153EAA64: CreateWindowExW.USER32 ref: 00007FF6153EAAB9
Part of subcall function 00007FF6153EAA64: IsWindow.USER32 ref: 00007FF6153EAAC6

Part of subcall function 00007FF6153EABF8: GetDlgItem.USER32 ref: 00007FF6153EAC22
Part of subcall function 00007FF6153EABF8: GetClientRect.USER32 ref: 00007FF6153EAC38
Part of subcall function 00007FF6153EABF8: MapWindowPoints.USER32 ref: 00007FF6153EAC4F

GetDlgItem.USER32 ref: 00007FF6153D67E1
SetFocus.USER32 ref: 00007FF6153D67EA
InvalidateRect.USER32 ref: 00007FF6153D680A

Strings

Static, xrefs: 00007FF6153D645B

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Item$MessageSend$Rect$Client$DestroyPointsShow$CriticalExceptionLongSectionThrow$BufferedCreateDataEnterErrorFocusInitInvalidateLastLeaveOpenPaintThememallocmemset
String ID: Static
API String ID: 3076799769-2272013587
Opcode ID: 046698a90a645948a4042b0895b9c2ed1ac81f7a693c8b28f8541e1fd8484cb3
Instruction ID: 6381d0d6c84ddfcdc113bbc50c8dcb4c0955b72ea1150f11205ec89a2979448d
Opcode Fuzzy Hash: 046698a90a645948a4042b0895b9c2ed1ac81f7a693c8b28f8541e1fd8484cb3
Instruction Fuzzy Hash: DB027236A24E5286EB10DF66E85856D73A5FB48F94F414436EE0E87764EF3CD846C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153DA1A0, Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 179timewindowCOMMON

Download Yara Rule

APIs

KillTimer.USER32 ref: 00007FF6153DA22A
FindWindowW.USER32 ref: 00007FF6153DA23D
SendNotifyMessageW.USER32 ref: 00007FF6153DA256
NotifyWinEvent.USER32 ref: 00007FF6153DA26B
GetClientRect.USER32 ref: 00007FF6153DA2E7
PtInRect.USER32 ref: 00007FF6153DA305
GetClientRect.USER32 ref: 00007FF6153DA354
CreateSolidBrush.GDI32 ref: 00007FF6153DA360
FillRect.USER32 ref: 00007FF6153DA374
DeleteObject.GDI32 ref: 00007FF6153DA37D

Part of subcall function 00007FF6153DAAE0: GetForegroundWindow.USER32(?,?,?,00007FF6153DA1FA), ref: 00007FF6153DAB08
Part of subcall function 00007FF6153DAAE0: GetWindowThreadProcessId.USER32 ref: 00007FF6153DAB1B
Part of subcall function 00007FF6153DAAE0: GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FF6153DA1FA), ref: 00007FF6153DAB21
Part of subcall function 00007FF6153DAAE0: GetDoubleClickTime.USER32(?,?,?,00007FF6153DA1FA), ref: 00007FF6153DAB2D
Part of subcall function 00007FF6153DAAE0: QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0(?,?,?,00007FF6153DA1FA), ref: 00007FF6153DAB41
Part of subcall function 00007FF6153DAAE0: KillTimer.USER32(?,?,?,00007FF6153DA1FA), ref: 00007FF6153DAB65
Part of subcall function 00007FF6153DAAE0: ShowWindow.USER32(?,?,?,00007FF6153DA1FA), ref: 00007FF6153DAB71
Part of subcall function 00007FF6153DAAE0: SetTimer.USER32 ref: 00007FF6153DAB87

ShowWindow.USER32 ref: 00007FF6153DA3B3
SetTimer.USER32 ref: 00007FF6153DA3CA
KillTimer.USER32 ref: 00007FF6153DA3E9
ShowWindow.USER32 ref: 00007FF6153DA3F8
PostQuitMessage.USER32 ref: 00007FF6153DA436
PostQuitMessage.USER32 ref: 00007FF6153DA45E

Strings

Shell_TrayWnd, xrefs: 00007FF6153DA234

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Timer$Rect$KillMessageShow$ClientNotifyPostProcessQuit$BrushClickCounterCreateCurrentDeleteDoubleEventFillFindForegroundObjectPerformanceQuerySendSolidThreadTime
String ID: Shell_TrayWnd
API String ID: 254931032-2988720461
Opcode ID: 36fb9df0462226383ccec5f12ef47359fccc498fe1b4e3f7b54263fa2fb2f493
Instruction ID: 20492e8d9513800ff7e98314161a842a014949384a8b31228b8b82082b9f39de
Opcode Fuzzy Hash: 36fb9df0462226383ccec5f12ef47359fccc498fe1b4e3f7b54263fa2fb2f493
Instruction Fuzzy Hash: AF717431A28E42C6EB60DB21D544579B7B1EB44FA4F804032E94EC7BA4EFBDDD868741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153D8310, Relevance: 28.7, APIs: 19, Instructions: 196windowCOMMON

Download Yara Rule

APIs

CreatePopupMenu.USER32 ref: 00007FF6153D8351

Part of subcall function 00007FF6153D8E00: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6153E244F,?,?,?,?,?,00007FF6153D7632,?,?,?,00007FF6153D5AE5), ref: 00007FF6153D8E0C

LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153D838F
memset.MSVCRT ref: 00007FF6153D83DA
InsertMenuItemW.USER32 ref: 00007FF6153D8432
CoTaskMemFree.OLE32 ref: 00007FF6153D8441
GetMenuItemCount.USER32 ref: 00007FF6153D8456
CheckMenuRadioItem.USER32 ref: 00007FF6153D8473
SendMessageW.USER32 ref: 00007FF6153D848B
MapWindowPoints.USER32 ref: 00007FF6153D84A1
GetWindowLongW.USER32 ref: 00007FF6153D84C0
TrackPopupMenuEx.USER32 ref: 00007FF6153D84F1
memset.MSVCRT ref: 00007FF6153D8510
GetMenuItemInfoW.USER32 ref: 00007FF6153D852F
InvalidateRect.USER32 ref: 00007FF6153D857A
GetMenuItemCount.USER32 ref: 00007FF6153D8585
memset.MSVCRT ref: 00007FF6153D8598
GetMenuItemInfoW.USER32 ref: 00007FF6153D85B7
GetMenuItemCount.USER32 ref: 00007FF6153D85D7
DestroyMenu.USER32 ref: 00007FF6153D85E4

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$Item$Countmemset$CriticalInfoPopupSectionWindow$CheckCreateDestroyEnterFreeInsertInvalidateLeaveLongMessagePointsRadioRectSendTaskTrack
String ID:
API String ID: 348811463-0
Opcode ID: 09510ea4b2e1dc9397f227fdbe85450171082760e7b4941e3a812fc010a47f5e
Instruction ID: f3d5b888104dc08de30a792d489501dcc1fc422ef093998394bab04d9572fe59
Opcode Fuzzy Hash: 09510ea4b2e1dc9397f227fdbe85450171082760e7b4941e3a812fc010a47f5e
Instruction Fuzzy Hash: 3E919C36B18A418AE710DF62D8546ADB3B1FB48FA8F404532DE0E97B64DF38E859C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153D3288, Relevance: 19.6, APIs: 13, Instructions: 112memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153D32B4
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6153D32F4
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6153D32FF
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6153D3314
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6153D3328
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6153D3333
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6153D3348
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6153D3358
ReleaseMutex.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153D3363
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6153D3378
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6153D33AE
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6153D33BC
ReleaseMutex.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153D33D1

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$CloseHandleHeapMutexRelease$FreeObjectProcessSingleWait
String ID:
API String ID: 1242941757-0
Opcode ID: 979ad76335b366c5c607477bd2d656fdf7081e052766f997e44b428721abcf0b
Instruction ID: 1996d960b8996ed3e03f79993ad0e2f21b5b796ac033c7dd6e0aeb26dc78bbc7
Opcode Fuzzy Hash: 979ad76335b366c5c607477bd2d656fdf7081e052766f997e44b428721abcf0b
Instruction Fuzzy Hash: D5413021B28E4286F7549B66A954239A3B0AF84FB0F580135EE5EC77F5EF2CEC558301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E3718, Relevance: 13.7, APIs: 9, Instructions: 229windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153E3765
CoTaskMemFree.OLE32 ref: 00007FF6153E37DB
PathParseIconLocationW.SHLWAPI ref: 00007FF6153E3826
CoTaskMemFree.OLE32 ref: 00007FF6153E385B
IsImmersiveProcess.USER32 ref: 00007FF6153E3888
OpenProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1 ref: 00007FF6153E3981
OpenProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1 ref: 00007FF6153E3A03

Part of subcall function 00007FF6153E75A4: SHLoadIndirectString.SHLWAPI ref: 00007FF6153E75D0

LoadStringW.USER32 ref: 00007FF6153E39BF
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153E3A2D

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CriticalFreeLoadOpenSectionStringTask$EnterIconImmersiveIndirectLeaveLocationParsePath
String ID:
API String ID: 1430165825-0
Opcode ID: 80104ee864b028e0e5ecd1e822c63e8e4a3093c84dc0cc8c1cecee3ccfabb482
Instruction ID: 8ed915135cffda8aae18e6f35d3dad3d6e0c288102fd326b874ea91f8a65b39b
Opcode Fuzzy Hash: 80104ee864b028e0e5ecd1e822c63e8e4a3093c84dc0cc8c1cecee3ccfabb482
Instruction Fuzzy Hash: 7BA15A32A28F4696EA55CF17D844279A3A0FF88FA0F444136EA5D976A4EF3CEC55C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E4F10, Relevance: 12.3, APIs: 8, Instructions: 296windowtimeCOMMON

Download Yara Rule

APIs

KillTimer.USER32 ref: 00007FF6153E4FA6

Part of subcall function 00007FF6153E5914: RegGetValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6153E598E
Part of subcall function 00007FF6153E5914: GetDlgItem.USER32 ref: 00007FF6153E59DB
Part of subcall function 00007FF6153E5914: OpenThemeData.UXTHEME ref: 00007FF6153E59FE
Part of subcall function 00007FF6153E5914: GetDlgItem.USER32 ref: 00007FF6153E5A14
Part of subcall function 00007FF6153E5914: GetDlgItem.USER32 ref: 00007FF6153E5A64
Part of subcall function 00007FF6153E5914: SendMessageW.USER32 ref: 00007FF6153E5AAF
Part of subcall function 00007FF6153E5914: GetDlgItem.USER32 ref: 00007FF6153E5ABE

SendMessageW.USER32 ref: 00007FF6153E5051
GetSysColorBrush.USER32 ref: 00007FF6153E5097
GetClientRect.USER32 ref: 00007FF6153E513F
DrawThemeParentBackgroundEx.UXTHEME ref: 00007FF6153E5153
SendMessageW.USER32 ref: 00007FF6153E5198
PostMessageW.USER32 ref: 00007FF6153E524E
DwmIsCompositionEnabled.DWMAPI ref: 00007FF6153E526C

Part of subcall function 00007FF6153EC0A4: DwmUnregisterThumbnail.DWMAPI(?,?,00000002,00007FF6153E52CD), ref: 00007FF6153EC0D3

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemMessage$Send$Theme$BackgroundBrushClientColorCompositionDataDrawEnabledKillOpenParentPostRectThumbnailTimerUnregisterValue
String ID:
API String ID: 1110118582-0
Opcode ID: f54d7f6a6d074fb7f6abe3e4439dc00e3a0fdd9359e034a3dd6743bf7c2dd84d
Instruction ID: fcdeeb2829ec03a6db668d9b819a0c7d26313c2ad0a422e19041f9bccc62d4a3
Opcode Fuzzy Hash: f54d7f6a6d074fb7f6abe3e4439dc00e3a0fdd9359e034a3dd6743bf7c2dd84d
Instruction Fuzzy Hash: 67C1AE72E28E4285FB609B6698446BCA2D0EB44FA8F544432DE0D976F4FF3CED818351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E9EF4, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetUserPreferredUILanguages.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000000,?,00007FF6153D471A), ref: 00007FF6153E9F1F
malloc.MSVCRT ref: 00007FF6153E9F2F
GetUserPreferredUILanguages.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6153E9F4B
GetLocaleInfoEx.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6153E9F6D
free.MSVCRT ref: 00007FF6153E9F82

Strings

Windows Volume App Window, xrefs: 00007FF6153E9EF9

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: LanguagesPreferredUser$InfoLocalefreemalloc
String ID: Windows Volume App Window
API String ID: 2042096692-2941154534
Opcode ID: c98a24284face0f20ce35a5ee7ddafddbb5b258a2097c14aca94ac1be79f750f
Instruction ID: c035dcdaa7c18c28b931c2aa875e9efe3de95386b1f3878b64a98cccdc1b5880
Opcode Fuzzy Hash: c98a24284face0f20ce35a5ee7ddafddbb5b258a2097c14aca94ac1be79f750f
Instruction Fuzzy Hash: 77114D33A24A529FE7558F75C8808E87760FB44FA9B54003AEA0A47A58EF39DDC6C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E1D64, Relevance: 6.0, APIs: 4, Instructions: 45comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,?,?,?,0000019C,00007FF6153D62CE), ref: 00007FF6153E1D92
ImageList_Create.COMCTL32 ref: 00007FF6153E1DD2
GetSysColor.USER32 ref: 00007FF6153E1DF0
ImageList_SetBkColor.COMCTL32 ref: 00007FF6153E1DFF

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ColorCreateImageList_$Instance
String ID:
API String ID: 2112797728-0
Opcode ID: 5674b0afc200a4782bcad8254b31ac4266ab3365beede3b62f42715ad1c32b10
Instruction ID: 19d7c61ff4671e56b7f7880a9f084c3a333378ea8d463106403f058250506b2f
Opcode Fuzzy Hash: 5674b0afc200a4782bcad8254b31ac4266ab3365beede3b62f42715ad1c32b10
Instruction Fuzzy Hash: 22112935A28E4696EB118B16F844569E3A0FF88FA4F044036DA0D97374EF3CEC89CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153D8E7C, Relevance: 4.5, APIs: 3, Instructions: 44COMMON

Download Yara Rule

APIs

LoadResource.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,FFFFFFFE,00007FF6153D8F69,?,?,FFFFFFFE,00007FF6153D90C7,?,?,?,00007FF6153DCBDD), ref: 00007FF6153D8E99
LockResource.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,FFFFFFFE,00007FF6153D8F69,?,?,FFFFFFFE,00007FF6153D90C7,?,?,?,00007FF6153DCBDD), ref: 00007FF6153D8EAB
SizeofResource.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,FFFFFFFE,00007FF6153D8F69,?,?,FFFFFFFE,00007FF6153D90C7,?,?,?,00007FF6153DCBDD), ref: 00007FF6153D8EBF

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 113071c546738a2478d5fbe6806af642f9988898e90c5da05a20c4eecd9adce0
Instruction ID: 43dc034bd0b5b17f113d426a6d975e8f234b58f1f8a4ae1eb4a1e223f676b9c9
Opcode Fuzzy Hash: 113071c546738a2478d5fbe6806af642f9988898e90c5da05a20c4eecd9adce0
Instruction Fuzzy Hash: 8D015612B29E9285DF548B15A800579E2A0AF95FA5B5C4535EA5D877A4FF3CEC408A00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153EF2E0, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6153EF2EB

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: cc01c4b63d7f9937f139ffc10e5145745944443b2bebd1832b63f384e0502c32
Instruction ID: 27a836523d52dcd544bb71ef7e05ba24c0ef9450d74890ae100bf38b3ca8de01
Opcode Fuzzy Hash: cc01c4b63d7f9937f139ffc10e5145745944443b2bebd1832b63f384e0502c32
Instruction Fuzzy Hash: 44B09228E36C02D6D604AB229C9106052A0AB98F20FC10531C00DC6130EF5C999ACB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153ED974, Relevance: 40.8, APIs: 27, Instructions: 296windowCOMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF6153EDA0C
CopyRect.USER32 ref: 00007FF6153EDA2F
GetParent.USER32 ref: 00007FF6153EDA48
SendMessageW.USER32 ref: 00007FF6153EDA5E
GetWindowLongW.USER32 ref: 00007FF6153EDA77
GetSysColorBrush.USER32 ref: 00007FF6153EDABD
GetClientRect.USER32 ref: 00007FF6153EDACE
GetParent.USER32 ref: 00007FF6153EDAE1
SendMessageW.USER32 ref: 00007FF6153EDAF6
FillRect.USER32 ref: 00007FF6153EDB05
SendMessageW.USER32 ref: 00007FF6153EDB62
DrawThemeBackground.UXTHEME ref: 00007FF6153EDB99
DrawEdge.USER32 ref: 00007FF6153EDBAE
GetParent.USER32 ref: 00007FF6153EDBCA
SendMessageW.USER32 ref: 00007FF6153EDBDF
CopyRect.USER32 ref: 00007FF6153EDBEF
FillRect.USER32 ref: 00007FF6153EDC95
BufferedPaintSetAlpha.UXTHEME ref: 00007FF6153EDCA3
GetSysColor.USER32 ref: 00007FF6153EDCD0
GetFocus.USER32 ref: 00007FF6153EDD81
SendMessageW.USER32 ref: 00007FF6153EDD9A
GetSysColor.USER32 ref: 00007FF6153EDDAB
SetBkColor.GDI32 ref: 00007FF6153EDDB6
GetClientRect.USER32 ref: 00007FF6153EDDC4
GetSysColorBrush.USER32 ref: 00007FF6153EDDCC
FrameRect.USER32 ref: 00007FF6153EDDDC
DrawFocusRect.USER32 ref: 00007FF6153EDDE9

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$ColorMessageSend$DrawParent$BrushClientCopyFillFocusLongWindow$AlphaBackgroundBufferedEdgeFramePaintTheme
String ID:
API String ID: 273098063-0
Opcode ID: dbebe8e3d9efa3ab3fc20a9c4cae55934b99ba9885d67eb0d0d32a03c0184337
Instruction ID: 954e7f0a7e66a563c4e17d397e8713dc48afc01ed5ac621705be3dfb7487d7f3
Opcode Fuzzy Hash: dbebe8e3d9efa3ab3fc20a9c4cae55934b99ba9885d67eb0d0d32a03c0184337
Instruction Fuzzy Hash: 14D1C136B24E41C6EB149B26D8046ADB3A1FB48F94F004536DE4E97B64EF3CE865C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E7938, Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 185windowthreadCOMMON

Download Yara Rule

APIs

OpenThemeData.UXTHEME ref: 00007FF6153E797A
GetWindowRect.USER32 ref: 00007FF6153E798F
GetParent.USER32 ref: 00007FF6153E7998
MapWindowPoints.USER32 ref: 00007FF6153E79B1
GetWindowTextLengthW.USER32 ref: 00007FF6153E79BA
malloc.MSVCRT ref: 00007FF6153E79EC
GetWindowTextW.USER32 ref: 00007FF6153E7A08
GetWindowLongW.USER32 ref: 00007FF6153E7A16
GetWindowLongW.USER32 ref: 00007FF6153E7A26
GetWindowLongW.USER32 ref: 00007FF6153E7A38
GetParent.USER32 ref: 00007FF6153E7A44
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6153E7A9A
free.MSVCRT ref: 00007FF6153E7AA8
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6153E7AFE
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153E7B0E
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153E7B2D
CreateWindowExW.USER32 ref: 00007FF6153E7BA7
GetClassLongW.USER32 ref: 00007FF6153E7BC3
SetClassLongW.USER32 ref: 00007FF6153E7BD4
SendMessageW.USER32 ref: 00007FF6153E7BE6
SendMessageW.USER32 ref: 00007FF6153E7BFA
GetClientRect.USER32 ref: 00007FF6153E7C08

Strings

BUTTON, xrefs: 00007FF6153E7971

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Long$ClassCriticalMessageParentRectSectionSendText$ClientCreateCurrentDataEnterErrorLastLeaveLengthOpenPointsThemeThreadfreemalloc
String ID: BUTTON
API String ID: 754467738-3405671355
Opcode ID: ab1be14984d8e19d033594064373a58e68e9e5f93b574f78cf3e00c33718f7d5
Instruction ID: 031d27181b4a83f9b9a0cf58ce735d3f379de969dd798dfb4165306f8c231a8c
Opcode Fuzzy Hash: ab1be14984d8e19d033594064373a58e68e9e5f93b574f78cf3e00c33718f7d5
Instruction Fuzzy Hash: 56817631629F4186EA259B25E804669B3A0FF88F70F414535EE5E877B4EF3CE845C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153D1554, Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 149windowthreadCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6153D162C
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6153D16A5

Part of subcall function 00007FF6153D14D4: _vsnwprintf.MSVCRT ref: 00007FF6153D150C

Strings

ReturnHr, xrefs: 00007FF6153D15EE
(caller: %p) , xrefs: 00007FF6153D1690
[%hs], xrefs: 00007FF6153D1768
%hs(%d) tid(%x) %08X %ws, xrefs: 00007FF6153D16B8
[%hs(%hs)], xrefs: 00007FF6153D174F
FailFast, xrefs: 00007FF6153D15DC
%hs!%p: , xrefs: 00007FF6153D1670
%hs(%d)\%hs!%p: , xrefs: 00007FF6153D1652
Msg:[%ws] , xrefs: 00007FF6153D170D
Exception, xrefs: 00007FF6153D15F7
, xrefs: 00007FF6153D16F2
CallContext:[%hs] , xrefs: 00007FF6153D1728
LogHr, xrefs: 00007FF6153D15E5

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentFormatMessageThread_vsnwprintf
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%d)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $ReturnHr$[%hs(%hs)]$[%hs]
API String ID: 223436642-2849347638
Opcode ID: def13a911b7114d7b289cab3f6902d78b5721e72a6ee691c22be37edc24265bd
Instruction ID: 8d36db8b35017fe95b5f0a6b2fe999342c804bc870e1082c710715a737cfc25b
Opcode Fuzzy Hash: def13a911b7114d7b289cab3f6902d78b5721e72a6ee691c22be37edc24265bd
Instruction Fuzzy Hash: 01614971A29E4282EA64DF51A4045B9A3B1FF44FA8F840136EE4D93779EF3CE955C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E9E0C, Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,00007FF6153E9B2B), ref: 00007FF6153E9E21
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,00007FF6153E9B2B), ref: 00007FF6153E9E3D
EncodePointer.API-MS-WIN-CORE-UTIL-L1-1-0(?,?,?,00007FF6153E9B2B), ref: 00007FF6153E9E4F
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,00007FF6153E9B2B), ref: 00007FF6153E9E66
EncodePointer.API-MS-WIN-CORE-UTIL-L1-1-0(?,?,?,00007FF6153E9B2B), ref: 00007FF6153E9E74
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,00007FF6153E9B2B), ref: 00007FF6153E9E8B
EncodePointer.API-MS-WIN-CORE-UTIL-L1-1-0(?,?,?,00007FF6153E9B2B), ref: 00007FF6153E9E99
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,00007FF6153E9B2B), ref: 00007FF6153E9EB0
EncodePointer.API-MS-WIN-CORE-UTIL-L1-1-0(?,?,?,00007FF6153E9B2B), ref: 00007FF6153E9EBE

Strings

atlthunk.dll, xrefs: 00007FF6153E9E14
AtlThunk_FreeData, xrefs: 00007FF6153E9E9F
AtlThunk_DataToCode, xrefs: 00007FF6153E9E7A
AtlThunk_AllocateData, xrefs: 00007FF6153E9E33
AtlThunk_InitData, xrefs: 00007FF6153E9E55

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressEncodePointerProc$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 634866520-1745123996
Opcode ID: 4ad129a261ae6a52e263b8988ca97a1371d934805b66734e7f27dd0d7d7b3ddd
Instruction ID: dd27c561c668cfae4f8dfce0162eb3c71c4d6111f877bba1913f9634fa7c0209
Opcode Fuzzy Hash: 4ad129a261ae6a52e263b8988ca97a1371d934805b66734e7f27dd0d7d7b3ddd
Instruction Fuzzy Hash: 45219421E3AF03D1FE059B51AC68534A3A0AF89F61F48443AD85D87374FF3CA8959322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153EE65C, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 136windowCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6153E1A2F), ref: 00007FF6153EE6B1
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6153E1A2F), ref: 00007FF6153EE6C1
PathFindExtensionW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6153E1A2F), ref: 00007FF6153EE6F0
_wcsicmp.MSVCRT ref: 00007FF6153EE705
LoadImageW.USER32 ref: 00007FF6153EE72A
LoadIconW.USER32 ref: 00007FF6153EE746
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6153E1A2F), ref: 00007FF6153EE80C
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6153E1A2F), ref: 00007FF6153EE830

Strings

.ico, xrefs: 00007FF6153EE6FB

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastLoad$EnvironmentExpandExtensionFindFreeIconImageLibraryPathStrings_wcsicmp
String ID: .ico
API String ID: 1073148659-3044193043
Opcode ID: f3613f676f91446a78160673b14fa5e34e8ad347261389a1c9fe5a4ea238fee6
Instruction ID: 66be430c7bde1e63d336b428e1291f67f91ef61d7b96ac1e322a91a38d8bec51
Opcode Fuzzy Hash: f3613f676f91446a78160673b14fa5e34e8ad347261389a1c9fe5a4ea238fee6
Instruction Fuzzy Hash: BB515C35B18F428AEB258B16A844669B6E0FB88FA4F444136ED5D837A4FF3DEC44D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153DFB00, Relevance: 21.2, APIs: 14, Instructions: 200COMMON

Download Yara Rule

APIs

BeginPaint.USER32 ref: 00007FF6153DFB57

Part of subcall function 00007FF6153E122C: GetDlgItem.USER32 ref: 00007FF6153E1263
Part of subcall function 00007FF6153E122C: GetWindowRect.USER32 ref: 00007FF6153E1271
Part of subcall function 00007FF6153E122C: GetDlgItem.USER32 ref: 00007FF6153E127D
Part of subcall function 00007FF6153E122C: GetParent.USER32 ref: 00007FF6153E1286
Part of subcall function 00007FF6153E122C: MapWindowPoints.USER32 ref: 00007FF6153E129A
Part of subcall function 00007FF6153E122C: GetDlgItem.USER32 ref: 00007FF6153E12A6
Part of subcall function 00007FF6153E122C: GetWindowTextW.USER32 ref: 00007FF6153E12BA
Part of subcall function 00007FF6153E122C: OpenThemeData.UXTHEME ref: 00007FF6153E12C9
Part of subcall function 00007FF6153E122C: DrawThemeText.UXTHEME ref: 00007FF6153E1309
Part of subcall function 00007FF6153E122C: CloseThemeData.UXTHEME ref: 00007FF6153E1314

Part of subcall function 00007FF6153E122C: GetDlgItem.USER32 ref: 00007FF6153E1322
Part of subcall function 00007FF6153E122C: ShowWindow.USER32 ref: 00007FF6153E1330

EndPaint.USER32 ref: 00007FF6153DFB93
EndDialog.USER32 ref: 00007FF6153DFC03
IsDlgButtonChecked.USER32 ref: 00007FF6153DFC73
GetDlgItem.USER32 ref: 00007FF6153DFC82
EnableWindow.USER32 ref: 00007FF6153DFC98
IsDlgButtonChecked.USER32 ref: 00007FF6153DFCB8
GetSysColorBrush.USER32 ref: 00007FF6153DFD08
GetSysColor.USER32 ref: 00007FF6153DFD1E
SetTextColor.GDI32 ref: 00007FF6153DFD29
GetSysColor.USER32 ref: 00007FF6153DFD34
SetBkColor.GDI32 ref: 00007FF6153DFD3F
GetDlgItem.USER32 ref: 00007FF6153DFDDF
EnableWindow.USER32 ref: 00007FF6153DFDF5

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemWindow$Color$TextTheme$ButtonCheckedDataEnablePaint$BeginBrushCloseDialogDrawOpenParentPointsRectShow
String ID:
API String ID: 621705839-0
Opcode ID: 76245af81261d540b709ddf2fcad88b32f5208057ddf4cd3663353eab610d44b
Instruction ID: 346c180bb8017ca1d2715c004caba813b79c509d5526ae9ad4d00a4abb3a214a
Opcode Fuzzy Hash: 76245af81261d540b709ddf2fcad88b32f5208057ddf4cd3663353eab610d44b
Instruction Fuzzy Hash: 7D817361B38E4686FA609B12E850279A2A0EF85F60F904431DA5EC77A5FF3CED528701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153DFEA0, Relevance: 21.1, APIs: 14, Instructions: 120windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6153DFEE6
GetDeviceCaps.GDI32 ref: 00007FF6153DFEF7
ReleaseDC.USER32 ref: 00007FF6153DFF13
LoadIconW.USER32 ref: 00007FF6153DFF25
SendMessageW.USER32 ref: 00007FF6153DFF3B
DwmSetWindowAttribute.DWMAPI ref: 00007FF6153DFF55
SetForegroundWindow.USER32 ref: 00007FF6153DFF5F
memset.MSVCRT ref: 00007FF6153DFF73
Shell_NotifyIconGetRect.SHELL32 ref: 00007FF6153DFF8F
GetWindowRect.USER32 ref: 00007FF6153DFFA1
CalculatePopupWindowPosition.USER32 ref: 00007FF6153DFFD7
SetWindowPos.USER32 ref: 00007FF6153E0001
InvalidateRect.USER32 ref: 00007FF6153E0011
GetDlgItem.USER32 ref: 00007FF6153E0055

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Rect$Icon$AttributeCalculateCapsDeviceForegroundInvalidateItemLoadMessageNotifyPopupPositionReleaseSendShell_memset
String ID:
API String ID: 1519383196-0
Opcode ID: 3036b207ac55c85cdc06877d3df2260a3b96434a8695e3bbb52c2b51731bdb52
Instruction ID: 239dc0397786790491880555586898dcf1fecb77f4fcc04f6eb6bc0d9615f8c3
Opcode Fuzzy Hash: 3036b207ac55c85cdc06877d3df2260a3b96434a8695e3bbb52c2b51731bdb52
Instruction Fuzzy Hash: 88513932B24E419AEB00DF22D8546ADB3A1FB88FA4F404536DA1D93B64EF38ED55C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153EC268, Relevance: 18.2, APIs: 12, Instructions: 153COMMON

Download Yara Rule

APIs

DwmQueryThumbnailSourceSize.DWMAPI ref: 00007FF6153EC2BC
SetRectEmpty.USER32 ref: 00007FF6153EC2E0
GetWindowLongPtrW.USER32 ref: 00007FF6153EC2F2
GetWindowLongPtrW.USER32 ref: 00007FF6153EC307
AdjustWindowRectEx.USER32 ref: 00007FF6153EC31D
MonitorFromRect.USER32 ref: 00007FF6153EC3D9
GetMonitorInfoW.API-MS-WIN-NTUSER-SYSPARAMS-L1-1-0 ref: 00007FF6153EC3ED
CopyRect.USER32 ref: 00007FF6153EC3FB
SetWindowPos.USER32 ref: 00007FF6153EC446
memset.MSVCRT ref: 00007FF6153EC456
SetRect.USER32 ref: 00007FF6153EC46C
DwmUpdateThumbnailProperties.DWMAPI ref: 00007FF6153EC494

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$Window$LongMonitorThumbnail$AdjustCopyEmptyFromInfoPropertiesQuerySizeSourceUpdatememset
String ID:
API String ID: 455144415-0
Opcode ID: 3e81466b690e76af1458571813607267e6c1e0ae6917903156aa0f14ea6a5ae4
Instruction ID: 741ae95d8b6f1a1414b225f793eb4d4384ae91f1b96dcdf411e4dbaea25431c5
Opcode Fuzzy Hash: 3e81466b690e76af1458571813607267e6c1e0ae6917903156aa0f14ea6a5ae4
Instruction Fuzzy Hash: F361C332B15A41CBE711CBB6D444AAD73B1FB88B98F414632DE0DA3664EF38E855CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153D861C, Relevance: 18.1, APIs: 12, Instructions: 81COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6153D8642
BeginPath.GDI32 ref: 00007FF6153D8689
GetClientRect.USER32 ref: 00007FF6153D86A0
GetSysColorBrush.USER32 ref: 00007FF6153D86AD
CreatePen.GDI32 ref: 00007FF6153D86C3
SetBkMode.GDI32 ref: 00007FF6153D86D2
SetBkMode.GDI32 ref: 00007FF6153D86F0
DeleteObject.GDI32 ref: 00007FF6153D86F9
EndPath.GDI32 ref: 00007FF6153D8702
PathToRegion.GDI32 ref: 00007FF6153D870F
SetWindowRgn.USER32 ref: 00007FF6153D8727
DeleteDC.GDI32 ref: 00007FF6153D8730

Part of subcall function 00007FF6153D5E18: EtwTraceMessage.NTDLL ref: 00007FF6153D5E41

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$DeleteMode$BeginBrushClientColorCreateMessageObjectRectRegionTraceWindow
String ID:
API String ID: 1566018628-0
Opcode ID: 70e8632f62c56754d4634c696b973e4598f29c57eb9d7949f584fe4b41dc2b1d
Instruction ID: 5aa5a3eff0fb4fe4de35d06cb8f3929326deec6ad9e2405fd1ac65e063e4f070
Opcode Fuzzy Hash: 70e8632f62c56754d4634c696b973e4598f29c57eb9d7949f584fe4b41dc2b1d
Instruction Fuzzy Hash: 34316521B28E42C6EA549F12E848569E3A0EF88FA4F444036DE4EC7775EF3CE8498701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153D4328, Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32 ref: 00007FF6153D4344
_wcsicmp.MSVCRT ref: 00007FF6153D4361
_wcsicmp.MSVCRT ref: 00007FF6153D437A
_wtoi.MSVCRT ref: 00007FF6153D43E2
wcstol.MSVCRT ref: 00007FF6153D4414
CoTaskMemAlloc.OLE32 ref: 00007FF6153D4445
CoTaskMemFree.OLE32 ref: 00007FF6153D44B3
GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF6153D44C8

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeTask_wcsicmp$AllocArgvCommandGlobalLine_wtoiwcstol
String ID:
API String ID: 165199315-0
Opcode ID: dbd3e42d2347d135ef9d46d4f105d20816dea64de933ea6e0c55d17545759f02
Instruction ID: e8e74351484e2eddbc51369b01349f843b69fc0e4a19c9100e131dbe0ffafe1b
Opcode Fuzzy Hash: dbd3e42d2347d135ef9d46d4f105d20816dea64de933ea6e0c55d17545759f02
Instruction Fuzzy Hash: 54512D21A28E4296EB508F15E8845B9B3B0EF44FA4B944136DA5EC36B4FF7CED94C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153EBAB4, Relevance: 16.6, APIs: 11, Instructions: 89windowCOMMON

Download Yara Rule

APIs

ImageList_ReplaceIcon.COMCTL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6153D55AA), ref: 00007FF6153EBAF1
memset.MSVCRT ref: 00007FF6153EBB17
GetDlgCtrlID.USER32 ref: 00007FF6153EBB2A
GetDlgCtrlID.USER32 ref: 00007FF6153EBB3D
ImageList_ReplaceIcon.COMCTL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6153D55AA), ref: 00007FF6153EBB5B
memset.MSVCRT ref: 00007FF6153EBB77
GetDlgCtrlID.USER32 ref: 00007FF6153EBB80
SendMessageW.USER32 ref: 00007FF6153EBBAD
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF6153D55AA), ref: 00007FF6153EBBC2
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,00007FF6153D55AA), ref: 00007FF6153EBBDF
ImageList_Remove.COMCTL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6153D55AA), ref: 00007FF6153EBBEC

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CtrlImageList_MessageSend$IconReplacememset$Remove
String ID:
API String ID: 2737755638-0
Opcode ID: a7841a504e9fc1fa208b4bd62d1da9872150b802aa9d485b7350e0f0628f5434
Instruction ID: 1a69177658ae0fc9d6cb7051d8fc38757b6f344005c190921e9e1430bd537702
Opcode Fuzzy Hash: a7841a504e9fc1fa208b4bd62d1da9872150b802aa9d485b7350e0f0628f5434
Instruction Fuzzy Hash: 19415B76A14A41CAE714DF76D85466D77A0FB88F68F104236DE1D87AA8EF38DC42C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153EBEF4, Relevance: 15.1, APIs: 10, Instructions: 122windowCOMMON

Download Yara Rule

APIs

GetDlgCtrlID.USER32 ref: 00007FF6153EBF1D
SendMessageW.USER32 ref: 00007FF6153EBF68
ImageList_Draw.COMCTL32 ref: 00007FF6153EBFBE
IsThemeActive.UXTHEME ref: 00007FF6153EBFDC
DrawThemeParentBackgroundEx.UXTHEME ref: 00007FF6153EBFF7
GetParent.USER32 ref: 00007FF6153EC007
SendMessageW.USER32 ref: 00007FF6153EC01C
FillRect.USER32 ref: 00007FF6153EC02C

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: DrawMessageParentSendTheme$ActiveBackgroundCtrlFillImageList_Rect
String ID:
API String ID: 595381378-0
Opcode ID: 37ad9a8d231cfbc463a6f5315c75bcf700916e12654c643507b42b7b4a6b0fe9
Instruction ID: 8eb2515cdfa5a612361a6806f8f6898e32c7a3b87e7fc9548baee9692296ac2d
Opcode Fuzzy Hash: 37ad9a8d231cfbc463a6f5315c75bcf700916e12654c643507b42b7b4a6b0fe9
Instruction Fuzzy Hash: BE414032628A4687E7658F6AE95466DB7A0FB44F64F044131EB4EC3A64EF3CEC558B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153D6B14, Relevance: 15.1, APIs: 10, Instructions: 113windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6153D6B53
MapWindowPoints.USER32 ref: 00007FF6153D6B6E
GetDlgItem.USER32 ref: 00007FF6153D6BA1
GetClientRect.USER32 ref: 00007FF6153D6BB1
MapWindowPoints.USER32 ref: 00007FF6153D6BC6
SendMessageW.USER32 ref: 00007FF6153D6BE2
MapWindowPoints.USER32 ref: 00007FF6153D6BF9
GetDlgItem.USER32 ref: 00007FF6153D6C18
GetClientRect.USER32 ref: 00007FF6153D6C28
MapWindowPoints.USER32 ref: 00007FF6153D6C3F

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: PointsWindow$ClientItemMessageRectSend
String ID:
API String ID: 1789942593-0
Opcode ID: 7138b65b7cba78e29ad1e2064ff1e4c2573b89dc56d5de10b8f77975c60d13d2
Instruction ID: 2d102b1bfcb1cf2ed4abea685ead2bbabb08d0fb70760e45913541d56a2c6d62
Opcode Fuzzy Hash: 7138b65b7cba78e29ad1e2064ff1e4c2573b89dc56d5de10b8f77975c60d13d2
Instruction Fuzzy Hash: A9517E76B20A55CAEB08CF61E8549AD73B4F748FA8F405432DE1A93B14DF38E965CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153DAAE0, Relevance: 15.1, APIs: 10, Instructions: 57timethreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,00007FF6153DA1FA), ref: 00007FF6153DAB08
GetWindowThreadProcessId.USER32 ref: 00007FF6153DAB1B
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FF6153DA1FA), ref: 00007FF6153DAB21
GetDoubleClickTime.USER32(?,?,?,00007FF6153DA1FA), ref: 00007FF6153DAB2D
QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0(?,?,?,00007FF6153DA1FA), ref: 00007FF6153DAB41
KillTimer.USER32(?,?,?,00007FF6153DA1FA), ref: 00007FF6153DAB65
ShowWindow.USER32(?,?,?,00007FF6153DA1FA), ref: 00007FF6153DAB71
SetTimer.USER32 ref: 00007FF6153DAB87
KillTimer.USER32(?,?,?,00007FF6153DA1FA), ref: 00007FF6153DAB9D
PostQuitMessage.USER32(?,?,?,00007FF6153DA1FA), ref: 00007FF6153DABA5

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: TimerWindow$KillProcess$ClickCounterCurrentDoubleForegroundMessagePerformancePostQueryQuitShowThreadTime
String ID:
API String ID: 3471079685-0
Opcode ID: eec17bbeaf288bbb90529981327b894f01b1458b8328c51fb8e929eb434dc46f
Instruction ID: 61e908c33258b9ada2941b25db5a705245b1eb7c9aa5724f59d421f1334d4a6e
Opcode Fuzzy Hash: eec17bbeaf288bbb90529981327b894f01b1458b8328c51fb8e929eb434dc46f
Instruction Fuzzy Hash: F3212F32A28E41C1EB149B25E984029B7B1FB84FA0F544036EA4E87774EF7CDC86C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E0614, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 118registryCOMMON

Download Yara Rule

APIs

RegGetValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6153E0671
RegGetValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6153E06D8
malloc.MSVCRT ref: 00007FF6153E070E
RegGetValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6153E074F
free.MSVCRT ref: 00007FF6153E07E2

Strings

SndVolPreferencesMask, xrefs: 00007FF6153E0656
SndVolSelectedDevices, xrefs: 00007FF6153E06CB, 00007FF6153E0742
Software\Microsoft\Multimedia\Audio\SndVol, xrefs: 00007FF6153E065D

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$freemalloc
String ID: SndVolPreferencesMask$SndVolSelectedDevices$Software\Microsoft\Multimedia\Audio\SndVol
API String ID: 1577283573-2701106244
Opcode ID: c42949a83b03aac1551871531fae6bef4168309974f86ec8c00acd8ecbaf72d0
Instruction ID: 0fae5f139f25b680ea3745603486ad43a4b3dc6fbade1328e7dde50b8c9de2cb
Opcode Fuzzy Hash: c42949a83b03aac1551871531fae6bef4168309974f86ec8c00acd8ecbaf72d0
Instruction Fuzzy Hash: 9D514D32629B4196EA608F15E948569B3A9FB88FB0F504236DA6D937B4EF3CD845C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153D7198, Relevance: 13.7, APIs: 9, Instructions: 166threadwindowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153D71CB
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153D73FC

Part of subcall function 00007FF6153EEA14: malloc.MSVCRT(?,?,?,?,?,?,00000000,00007FF6153D45FD), ref: 00007FF6153EEA2E

SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6153D731C
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6153D7344
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153D7354
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153D7373
CreateDialogParamW.USER32 ref: 00007FF6153D7395
SendMessageW.USER32 ref: 00007FF6153D73DC
ShowWindow.USER32 ref: 00007FF6153D73EB

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave$CreateCurrentDialogErrorLastMessageParamSendShowThreadWindowmalloc
String ID:
API String ID: 413872373-0
Opcode ID: 70b62ca41da574dae0ac7d051af1e5d0f1c5cad35d529ef096ec4ac69703c546
Instruction ID: 1f41b79bd41c2baf539eea1ea05a955d586ca3fd4ca5c3a037c6249471d17926
Opcode Fuzzy Hash: 70b62ca41da574dae0ac7d051af1e5d0f1c5cad35d529ef096ec4ac69703c546
Instruction Fuzzy Hash: 5D714C22A29F8682EB5A8B55E844378B3B4FB44F60F554535EE5D877A0EF3CEC568300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153DBA7C, Relevance: 13.6, APIs: 9, Instructions: 87windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6153DBAB1
Shell_NotifyIconGetRect.SHELL32 ref: 00007FF6153DBACD
GetWindowRect.USER32 ref: 00007FF6153DBAE3
DwmIsCompositionEnabled.DWMAPI ref: 00007FF6153DBAF2
Shell_NotifyIconGetRect.SHELL32 ref: 00007FF6153DBB15
InflateRect.USER32 ref: 00007FF6153DBB2E
CalculatePopupWindowPosition.USER32 ref: 00007FF6153DBB64
SetWindowPos.USER32 ref: 00007FF6153DBB97
InvalidateRect.USER32 ref: 00007FF6153DBBA7

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$Window$IconNotifyShell_$CalculateCompositionEnabledInflateInvalidatePopupPositionmemset
String ID:
API String ID: 3975249420-0
Opcode ID: f11cb1ccf13ffa5726d6f9f5043c18a69663b5e7000d2121a0db0dd1b10c0dcc
Instruction ID: 42ecda7105373df3f45846fe3fce0077d0ab947c54e364f93313ad0bc7dc98ae
Opcode Fuzzy Hash: f11cb1ccf13ffa5726d6f9f5043c18a69663b5e7000d2121a0db0dd1b10c0dcc
Instruction Fuzzy Hash: D3413B73B24A429AE7108F65D8906AC7370EB48F5CF404536DE0D97A68EF38E948CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153EB9A4, Relevance: 13.6, APIs: 9, Instructions: 65windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,00000001,00007FF6153DB938,?,?,?,?,?,?,00000001,00007FF6153D5705), ref: 00007FF6153EB9C5
GetWindowLongW.USER32 ref: 00007FF6153EB9DF
SetWindowLongW.USER32 ref: 00007FF6153EB9F7
ImageList_Create.COMCTL32 ref: 00007FF6153EBA13
SendMessageW.USER32 ref: 00007FF6153EBA37
SendMessageW.USER32 ref: 00007FF6153EBA4D
SendMessageW.USER32 ref: 00007FF6153EBA63
SendMessageW.USER32 ref: 00007FF6153EBA78
SendMessageW.USER32 ref: 00007FF6153EBA92

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$LongWindow$CreateImageList_
String ID:
API String ID: 141019663-0
Opcode ID: 0b6372026e960e14e6840a54f59cb6ae973947d010e45fe7ef1847b4e3f17a91
Instruction ID: 69481bbc77eee1878568a4f7894f25f9920af5fc489b80604374179baf3a0039
Opcode Fuzzy Hash: 0b6372026e960e14e6840a54f59cb6ae973947d010e45fe7ef1847b4e3f17a91
Instruction Fuzzy Hash: E5218036724E9186E7108F25E821B2A6360FB88F69F144531EE0D8BB68DF3CCC46C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E76D0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

DrawThemeParentBackgroundEx.UXTHEME ref: 00007FF6153E7789
GetClientRect.USER32 ref: 00007FF6153E77A2
InvalidateRect.USER32 ref: 00007FF6153E77CA
CloseThemeData.UXTHEME ref: 00007FF6153E7812
OpenThemeData.UXTHEME ref: 00007FF6153E7821
InvalidateRect.USER32 ref: 00007FF6153E7834

Part of subcall function 00007FF6153E7EF4: BeginPaint.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6153E7726), ref: 00007FF6153E7F36
Part of subcall function 00007FF6153E7EF4: EndPaint.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6153E7726), ref: 00007FF6153E7FA4

Strings

BUTTON, xrefs: 00007FF6153E7818

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: RectTheme$DataInvalidatePaint$BackgroundBeginClientCloseDrawOpenParent
String ID: BUTTON
API String ID: 1060357982-3405671355
Opcode ID: eeb1f49965ae64cd95c67f9f9452823cc21789edcc9e1c6d82d7a7202d34cc96
Instruction ID: e6f2f9ac5533765cfa1a23d01dffc64667e027e8ee7d0e512d67e25a11bf10c1
Opcode Fuzzy Hash: eeb1f49965ae64cd95c67f9f9452823cc21789edcc9e1c6d82d7a7202d34cc96
Instruction Fuzzy Hash: 13418E32E24F8285EB218F26E4446B8B3A0FB44F68F104536DE4D87A70EF38EC958740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E6294, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,00000002,00007FF6153E4FC1), ref: 00007FF6153E62C4
SendMessageW.USER32(?,?,?,?,00000002,00007FF6153E4FC1), ref: 00007FF6153E62F6
SendMessageW.USER32(?,?,?,?,00000002,00007FF6153E4FC1), ref: 00007FF6153E630E
SendMessageW.USER32(?,?,?,?,00000002,00007FF6153E4FC1), ref: 00007FF6153E63C8
InvalidateRect.USER32(?,?,?,?,00000002,00007FF6153E4FC1), ref: 00007FF6153E63F9
InvalidateRect.USER32(?,?,?,?,00000002,00007FF6153E4FC1), ref: 00007FF6153E640C

Strings

.Default, xrefs: 00007FF6153E6343

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$InvalidateRect
String ID: .Default
API String ID: 2778011698-944851248
Opcode ID: 656182a45122aef493ebd17f54669532950710085266074fbf7e17e976b816ee
Instruction ID: 47dd8c0d9cf7dab9defc8a9b85ce0dddbe079838f974779a98b1dbf568a6630f
Opcode Fuzzy Hash: 656182a45122aef493ebd17f54669532950710085266074fbf7e17e976b816ee
Instruction Fuzzy Hash: CB41A226A24A4186E7158B26E9543B9F3A0FF58F94F098232DA0993674DF38AC558701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153D76C8, Relevance: 12.1, APIs: 8, Instructions: 113windowtimeCOMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,00007FF6153D5980), ref: 00007FF6153D76F7
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,00007FF6153D5980), ref: 00007FF6153D7893

Part of subcall function 00007FF6153EAD04: SystemParametersInfoW.API-MS-WIN-NTUSER-SYSPARAMS-L1-1-0 ref: 00007FF6153EAD1F

PostMessageW.USER32 ref: 00007FF6153D77BB
SetTimer.USER32 ref: 00007FF6153D77E7
PostMessageW.USER32 ref: 00007FF6153D7822
SendMessageW.USER32(?,?,?,?,?,?,?,00007FF6153D5980), ref: 00007FF6153D7835
SetTimer.USER32 ref: 00007FF6153D7869
SendMessageW.USER32(?,?,?,?,?,?,?,00007FF6153D5980), ref: 00007FF6153D7881

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$CriticalPostSectionSendTimer$EnterInfoLeaveParametersSystem
String ID:
API String ID: 4022514664-0
Opcode ID: 2d1b9c6faef5508a4a1a12bf6f6891c41d7dcf18ec98ceb83a66cb13f9a34495
Instruction ID: d6cc3ca5627659625a40aa121072f0fc3f2f415368a59f37008b56294741a5a6
Opcode Fuzzy Hash: 2d1b9c6faef5508a4a1a12bf6f6891c41d7dcf18ec98ceb83a66cb13f9a34495
Instruction Fuzzy Hash: 1151BF36A24A81C6E7528F26E5457A8B3A0FB48F94F594232DF0D9B764EF39E841C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E3AD0, Relevance: 12.1, APIs: 8, Instructions: 112windowCOMMON

Download Yara Rule

APIs

OpenProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1 ref: 00007FF6153E3B2A
OpenProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1 ref: 00007FF6153E3B6C

Part of subcall function 00007FF6153E74F0: QueryFullProcessImageNameW.API-MS-WIN-CORE-PSAPI-L1-1-0 ref: 00007FF6153E7536
Part of subcall function 00007FF6153E74F0: SHGetFileInfoW.SHELL32 ref: 00007FF6153E755D
Part of subcall function 00007FF6153E74F0: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6153E7575

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153E3B8B
CoTaskMemFree.OLE32 ref: 00007FF6153E3BC5
CoTaskMemFree.OLE32 ref: 00007FF6153E3BCD
DestroyIcon.USER32 ref: 00007FF6153E3BEF
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153E3C06
PostMessageW.USER32 ref: 00007FF6153E3C3B

Part of subcall function 00007FF6153E7254: EnumWindows.USER32 ref: 00007FF6153E7281

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CriticalFreeOpenSectionTask$CloseDestroyEnterEnumFileFullHandleIconImageInfoLeaveMessageNamePostQueryWindows
String ID:
API String ID: 2382067919-0
Opcode ID: 6836b1d9b63b34a1d808635953c38c64fef747e2b6bd346bc724800d75879172
Instruction ID: de8a30aea917b69826d2951248746e8916fd56bffe2cddf628d65c3bbe9e26e4
Opcode Fuzzy Hash: 6836b1d9b63b34a1d808635953c38c64fef747e2b6bd346bc724800d75879172
Instruction Fuzzy Hash: FB414D32A28E5285EB559F66D840679A3E1FF44FA8F144035DD0E97AB8EF38EC46C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E7140, Relevance: 12.1, APIs: 8, Instructions: 77windowmemorythreadCOMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF6153E7173
GetWindowLongW.USER32 ref: 00007FF6153E7182
IsWindowVisible.USER32 ref: 00007FF6153E7195
IsWindowVisible.USER32 ref: 00007FF6153E71AC
GhostWindowFromHungWindow.USER32 ref: 00007FF6153E71BE
GetWindowThreadProcessId.USER32 ref: 00007FF6153E71D1
InternalGetWindowText.USER32 ref: 00007FF6153E71F1
CoTaskMemAlloc.OLE32 ref: 00007FF6153E7204

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Visible$AllocFromGhostHungInternalLongProcessTaskTextThread
String ID:
API String ID: 2638675734-0
Opcode ID: 9db9aef3ff5031b50467588f5266a5354fc68479736cf2edab2dfab9b14fb4bd
Instruction ID: 53e710bb5704559fc38fd488d3a89db637c5d29e52bcb8e45a91d5d3e30b8f95
Opcode Fuzzy Hash: 9db9aef3ff5031b50467588f5266a5354fc68479736cf2edab2dfab9b14fb4bd
Instruction Fuzzy Hash: FA315221A29E8782EA219B12F994379A3D1FF44FA0F444431EE4E87674FF3CEC458601

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E8290, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF6153E8313
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF6153E834D
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF6153E83AD
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF6153E83D0
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF6153E8455

Strings

Windows.Internal.StateRepository.PackageResourceResolver, xrefs: 00007FF6153E830C

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: StringWindows$Delete$ActivationBufferCreateFactoryReference
String ID: Windows.Internal.StateRepository.PackageResourceResolver
API String ID: 1562191366-1869680290
Opcode ID: e458b2014b3fbe092f5af241e85c71dfeff078d8dd923a675c04305b6e42f011
Instruction ID: 0e1852be91bdc586857e41c8e813b0d004e49cc1ecb5597bded25805e0db565b
Opcode Fuzzy Hash: e458b2014b3fbe092f5af241e85c71dfeff078d8dd923a675c04305b6e42f011
Instruction Fuzzy Hash: 5461FB26B25F1689EB44CBAAD8406ADB7B1FB44FA8B050536CE1D97B74DF38D855C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153DC558, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142threadwindowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6153DC609
SendMessageW.USER32 ref: 00007FF6153DC64A
CreateThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6153DC747
SetThreadPriority.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6153DC75C
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6153DC76E

Part of subcall function 00007FF6153DD3D0: GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6153DD423
Part of subcall function 00007FF6153DD3D0: GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6153DD4D7

Strings

VolumeChange, xrefs: 00007FF6153DC5E2

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$Current$CloseCreateHandleMessagePrioritySendmemset
String ID: VolumeChange
API String ID: 3236076460-2114565508
Opcode ID: c94267a254af0460949f6b4b7107af34f61252e258578036ce730c1f54a5f2b2
Instruction ID: 0e390456ca959deccbb56648c649f3668044c753b7261884c67d35fc6a630d4d
Opcode Fuzzy Hash: c94267a254af0460949f6b4b7107af34f61252e258578036ce730c1f54a5f2b2
Instruction Fuzzy Hash: 4A714B32624F858AEB50DF25E8442A9B7B4FB88F64F540136DA8D97778EF38E945C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153ED290, Relevance: 10.6, APIs: 7, Instructions: 117COMMON

Download Yara Rule

APIs

GdipCreateFromHDC.GDIPLUS ref: 00007FF6153ED2EB
GdipSetSmoothingMode.GDIPLUS ref: 00007FF6153ED2FD
GdipCreateLineBrush.GDIPLUS ref: 00007FF6153ED39E
GdipCreateLineBrush.GDIPLUS ref: 00007FF6153ED416
GdipFillRectangle.GDIPLUS ref: 00007FF6153ED43A
GdipDeleteBrush.GDIPLUS ref: 00007FF6153ED443
GdipDeleteGraphics.GDIPLUS ref: 00007FF6153ED44C

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Gdip$BrushCreate$DeleteLine$FillFromGraphicsModeRectangleSmoothing
String ID:
API String ID: 2427137659-0
Opcode ID: d6443a4b4e03bb820450d6e6e470eb737593de9195646ce22e46140ad25d3c9e
Instruction ID: 7a18e85918f9533bedb86bc111540b63c916a072db867c962412626d79eb54a7
Opcode Fuzzy Hash: d6443a4b4e03bb820450d6e6e470eb737593de9195646ce22e46140ad25d3c9e
Instruction Fuzzy Hash: B2518D22A24F8489E711CB76D4403ADB374FB6DB98F059326EE4933764DF399986C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153D4EA0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32 ref: 00007FF6153D4F4E
GetWindowLongPtrW.USER32 ref: 00007FF6153D4F5F
CallWindowProcW.USER32 ref: 00007FF6153D4F7E
GetWindowLongPtrW.USER32 ref: 00007FF6153D4F9E
SetWindowLongPtrW.USER32 ref: 00007FF6153D4FB6

Strings

8, xrefs: 00007FF6153D4F0D

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Long$CallProc
String ID: 8
API String ID: 513923721-4194326291
Opcode ID: bf6ca4bcdae83b73eb44efcfdf8d25f4cf8645db5ebc1eb87d40f0387e468494
Instruction ID: 56c7be5cc36ddcb9707c0d7e08145b36cc0a0561f1ee20cc9727f9b41cbaeec2
Opcode Fuzzy Hash: bf6ca4bcdae83b73eb44efcfdf8d25f4cf8645db5ebc1eb87d40f0387e468494
Instruction Fuzzy Hash: 83414A32A24F518AE7108F26E88466DB3B8F748FA8F144225EE5D97768DF39C852C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153D8238, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6153D8253
GetDlgItem.USER32 ref: 00007FF6153D8279
SendMessageW.USER32 ref: 00007FF6153D8292
GetDlgItem.USER32 ref: 00007FF6153D82A1
SendMessageW.USER32 ref: 00007FF6153D82B5

Strings

0, xrefs: 00007FF6153D8261

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemMessageSend$memset
String ID: 0
API String ID: 1267807406-4108050209
Opcode ID: 4acd9a494a9ded9b36e949e5946e22ad87d91b845e8bd69a627395da5b7d90f3
Instruction ID: 09ac1e5e735e2671da80877a61af99735e49abdf089b66f133fa4407efe36230
Opcode Fuzzy Hash: 4acd9a494a9ded9b36e949e5946e22ad87d91b845e8bd69a627395da5b7d90f3
Instruction Fuzzy Hash: AB21A876A2894286FB204F51E51177AB660FB88FA8F444131DB9E87BE4DF3CD921CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E7604, Relevance: 10.6, APIs: 7, Instructions: 56windowthreadCOMMON

Download Yara Rule

APIs

FindWindowW.USER32 ref: 00007FF6153E7627
IsWindow.USER32 ref: 00007FF6153E7638
IsWindowVisible.USER32 ref: 00007FF6153E7649
GetWindowThreadProcessId.USER32 ref: 00007FF6153E765B
GetWindow.USER32 ref: 00007FF6153E7673
IsWindowVisible.USER32 ref: 00007FF6153E7683
GetParent.USER32 ref: 00007FF6153E7693

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Visible$FindParentProcessThread
String ID:
API String ID: 4241841604-0
Opcode ID: 6390ceca6080a22b85481e180e8494daebea48b927d451249c96e3300ef88312
Instruction ID: d2eaeb9ae03533ce7f7443b1d9dff69f16c2a3c9332fbacf54aab62d0c9cc69a
Opcode Fuzzy Hash: 6390ceca6080a22b85481e180e8494daebea48b927d451249c96e3300ef88312
Instruction Fuzzy Hash: 58113321B29F8282EA559F17A94413AE2A5EF85FE4F544035ED4E87B64EF3CEC518700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E72A8, Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

QueryFullProcessImageNameW.API-MS-WIN-CORE-PSAPI-L1-1-0 ref: 00007FF6153E72F1
#348.SHLWAPI ref: 00007FF6153E732B
memset.MSVCRT ref: 00007FF6153E7354
SHGetFileInfoW.SHELL32 ref: 00007FF6153E7375
PathFindFileNameW.SHLWAPI ref: 00007FF6153E739D

Part of subcall function 00007FF6153EE5EC: CoTaskMemAlloc.OLE32 ref: 00007FF6153EE621

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6153E73C7

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: FileName$#348AllocCloseFindFullHandleImageInfoPathProcessQueryTaskmemset
String ID:
API String ID: 3076885330-0
Opcode ID: c44842dc7232a1f9c542c86140a44780219783450fba7ed145712ff8df636066
Instruction ID: 97b6b5999ce21f1eaf8ed078f54ec649497e69bfe78c724788268ec27d799921
Opcode Fuzzy Hash: c44842dc7232a1f9c542c86140a44780219783450fba7ed145712ff8df636066
Instruction Fuzzy Hash: 8D319222628E8185F761CF62E8443E9A3A5FB84F54F444036EA5D87AA5EF3CDE45C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E5F20, Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

BeginPaint.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002), ref: 00007FF6153E5F63
GetClientRect.USER32 ref: 00007FF6153E5F7A
CreateSolidBrush.GDI32 ref: 00007FF6153E5F90
FillRect.USER32 ref: 00007FF6153E5FA4
DeleteObject.GDI32 ref: 00007FF6153E5FAD
EndPaint.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002), ref: 00007FF6153E5FC1

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: PaintRect$BeginBrushClientCreateDeleteFillObjectSolid
String ID:
API String ID: 2764081869-0
Opcode ID: 32b5a7a0c1a684b4284cf6084e619100583898e07b9c19f7c2481a6212e36af2
Instruction ID: 9f173691526b1a3933f73707c4471fc65aa9b0c29dfdf9a9f1c447c73149e693
Opcode Fuzzy Hash: 32b5a7a0c1a684b4284cf6084e619100583898e07b9c19f7c2481a6212e36af2
Instruction Fuzzy Hash: AB214525628F85C5EA60DF12E854769B7A0FB88FA4F444432EE4D87B65EF3CD946CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E02E4, Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6153E0307
GetClientRect.USER32 ref: 00007FF6153E0315
GetDlgItem.USER32 ref: 00007FF6153E0321
MapWindowPoints.USER32 ref: 00007FF6153E0339
GetDlgItem.USER32 ref: 00007FF6153E0345
SetWindowPos.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6153E0264), ref: 00007FF6153E0385

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$Window$ClientPointsRect
String ID:
API String ID: 846787704-0
Opcode ID: 879b822376c3d3020ab4c2ae275da1b0973e43ca6e56bfdf04fa075599c0c765
Instruction ID: 0eb7670c4fafc19da7f6154fa0f277dcbb606dadb23e22bc2e981ac302b9158d
Opcode Fuzzy Hash: 879b822376c3d3020ab4c2ae275da1b0973e43ca6e56bfdf04fa075599c0c765
Instruction Fuzzy Hash: CC111C76A28A8187EB14CF25E85446AB761FBC8FA4F144126EE4E43B28DF3CD845CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153D7624, Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6153E2424: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153E2481

GetDlgItem.USER32 ref: 00007FF6153D7640
ShowWindow.USER32(?,?,?,00007FF6153D5AE5), ref: 00007FF6153D764B

Part of subcall function 00007FF6153D7AB0: memset.MSVCRT ref: 00007FF6153D7AE0
Part of subcall function 00007FF6153D7AB0: GetDlgItem.USER32 ref: 00007FF6153D7B10
Part of subcall function 00007FF6153D7AB0: SendMessageW.USER32 ref: 00007FF6153D7B29

GetDlgItem.USER32 ref: 00007FF6153D7672
ShowWindow.USER32(?,?,?,00007FF6153D5AE5), ref: 00007FF6153D767D
GetDlgItem.USER32 ref: 00007FF6153D76A1
ShowWindow.USER32(?,?,?,00007FF6153D5AE5), ref: 00007FF6153D76AF

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$ShowWindow$CriticalLeaveMessageSectionSendmemset
String ID:
API String ID: 796547721-0
Opcode ID: a316600ff2c54e7bb8fff710f42ad2b7098adc331decc7e321fc5b2a9e31e96d
Instruction ID: 5d7f16c628aab834a35ae28d40031a6a21306f96833f323ebfdf64874a29563d
Opcode Fuzzy Hash: a316600ff2c54e7bb8fff710f42ad2b7098adc331decc7e321fc5b2a9e31e96d
Instruction Fuzzy Hash: 931184A5B24E82C2EF295B26D84423AA372EF84FA0F448031D90E87768FF3DDC518710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E8F0C, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

multimedia\deviceui\volume\sndvolexe\immersiveicon.cpp, xrefs: 00007FF6153E8F51, 00007FF6153E8F91, 00007FF6153E902C

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: multimedia\deviceui\volume\sndvolexe\immersiveicon.cpp
API String ID: 0-409861629
Opcode ID: e3e02c3768e09172a2e787a41d541998453fd975d428441eafd406c0a46dce81
Instruction ID: cfe2f69157774acc3c8896230cf46db0b5be9276e23b6ecad14ea2960cdae447
Opcode Fuzzy Hash: e3e02c3768e09172a2e787a41d541998453fd975d428441eafd406c0a46dce81
Instruction Fuzzy Hash: 83512036B24F168AEB118B6AD8406A867A1FB48FA8F514132ED1DD7764EF39DC458340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153EAB2C, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6153EAB70
CopyRect.USER32 ref: 00007FF6153EAB7F
SendMessageW.USER32 ref: 00007FF6153EABB5
SendMessageW.USER32 ref: 00007FF6153EABD2

Strings

H, xrefs: 00007FF6153EAB91

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$CopyRectmemset
String ID: H
API String ID: 1014080333-2852464175
Opcode ID: 024978f10c18b2cf3bee16e9a2b2f2dcca12a30652dbe94d0d2fec22088d325f
Instruction ID: 7f7a8c7068fcf12b8bbb0fc315bd90007561e3d1ac5133a09cde5452697336b6
Opcode Fuzzy Hash: 024978f10c18b2cf3bee16e9a2b2f2dcca12a30652dbe94d0d2fec22088d325f
Instruction Fuzzy Hash: E7114562618A8186E7608F15E8117AAB3A1FB88B94F845135EA8D47A55EF3CD949CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153EAA64, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00007FF6153EAAB9
IsWindow.USER32 ref: 00007FF6153EAAC6
SetWindowPos.USER32 ref: 00007FF6153EAAF7
SetWindowPos.USER32 ref: 00007FF6153EAB1D

Strings

tooltips_class32, xrefs: 00007FF6153EAA71

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Create
String ID: tooltips_class32
API String ID: 870168347-1918224756
Opcode ID: 6c3ada5e6de32017afe43d98bcd36c8eff4083bf761eccc9c8b636f49ea94388
Instruction ID: b57e3425916e443278c9b22bab33c23cf93663d4241ddcad7f6832c16b1f1828
Opcode Fuzzy Hash: 6c3ada5e6de32017afe43d98bcd36c8eff4083bf761eccc9c8b636f49ea94388
Instruction Fuzzy Hash: 18218072628A4187E7608F24E858B6977A0F748F79F100329EA6D87AE4DF7CC5448B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153EF564, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF6153EF58C
RtlLookupFunctionEntry.NTDLL ref: 00007FF6153EF5A5
RtlVirtualUnwind.NTDLL ref: 00007FF6153EF5E1
OutputDebugStringA.API-MS-WIN-CORE-DEBUG-L1-1-0 ref: 00007FF6153EF610

Strings

Invalid parameter passed to C runtime function., xrefs: 00007FF6153EF609

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CaptureContextDebugEntryFunctionLookupOutputStringUnwindVirtual
String ID: Invalid parameter passed to C runtime function.
API String ID: 711593133-455672764
Opcode ID: 365b0c4ffe58f1217c29b710acc49a5ea5948a203b6ce9307eb3c8f69adb6ec7
Instruction ID: f1a7de076d584df61ffd6abadd870501ba2998b0f662efa259667dd1b04cc2ad
Opcode Fuzzy Hash: 365b0c4ffe58f1217c29b710acc49a5ea5948a203b6ce9307eb3c8f69adb6ec7
Instruction Fuzzy Hash: 0E11EF36628F8192DA608B11F4953AAB360FB98F55F501136DA8D83BA4EF3CD548CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153D7AB0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6153E2424: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153E2481

SetDlgItemTextW.USER32 ref: 00007FF6153D7B3D

Part of subcall function 00007FF6153D7B50: GetDC.USER32 ref: 00007FF6153D7C0D
Part of subcall function 00007FF6153D7B50: GetDlgItem.USER32 ref: 00007FF6153D7C23
Part of subcall function 00007FF6153D7B50: SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00007FF6153D7C36
Part of subcall function 00007FF6153D7B50: SelectObject.GDI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00007FF6153D7C42
Part of subcall function 00007FF6153D7B50: ScriptStringAnalyse.GDI32 ref: 00007FF6153D7C96
Part of subcall function 00007FF6153D7B50: ScriptString_pLogAttr.GDI32 ref: 00007FF6153D7CA8
Part of subcall function 00007FF6153D7B50: DrawTextW.USER32 ref: 00007FF6153D7CCE

memset.MSVCRT ref: 00007FF6153D7AE0
GetDlgItem.USER32 ref: 00007FF6153D7B10
SendMessageW.USER32 ref: 00007FF6153D7B29

Strings

0, xrefs: 00007FF6153D7AF3

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$MessageScriptSendText$AnalyseAttrCriticalDrawLeaveObjectSectionSelectStringString_pmemset
String ID: 0
API String ID: 4198743150-4108050209
Opcode ID: 8f5c1fca4ebebe08e29eb5f695b51342e409285788a87cdd34fbaeefd3acc6f6
Instruction ID: 97c4eb1cab04a6c3b43c0c8f572e7ef1ae946ae83f22c8d9c346faa13c81466b
Opcode Fuzzy Hash: 8f5c1fca4ebebe08e29eb5f695b51342e409285788a87cdd34fbaeefd3acc6f6
Instruction Fuzzy Hash: DB01B972A18A8582E7249F12F40426DF361FB88FE8F544131EA9D87B99DF3CD9618B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E0580, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6153E05A3
GetClientRect.USER32 ref: 00007FF6153E05B1
memset.MSVCRT ref: 00007FF6153E05C2
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6153E0F3A), ref: 00007FF6153E05F9

Strings

(, xrefs: 00007FF6153E05D5

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$ClientMessageRectSend
String ID: (
API String ID: 3746668151-3887548279
Opcode ID: 503cb18923e45f5601cbc2ca12922c08ca593a7af46888c99fcae4fe3884ef31
Instruction ID: 26f9db4851e4c2f48567b604c4b4d9cb68d442e613d362eddd0d1d7536262d99
Opcode Fuzzy Hash: 503cb18923e45f5601cbc2ca12922c08ca593a7af46888c99fcae4fe3884ef31
Instruction Fuzzy Hash: 76012D76A3898586EB50CF25E45545AB3A1FBC8F54F805022F68E87A68DF7CD985CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E6E98, Relevance: 7.6, APIs: 5, Instructions: 132windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF6153D7586,?,?,?,00007FF6153D593D), ref: 00007FF6153E6EBB
free.MSVCRT(?,?,?,00007FF6153D7586,?,?,?,00007FF6153D593D), ref: 00007FF6153E6F43
PostMessageW.USER32 ref: 00007FF6153E7008
PostMessageW.USER32 ref: 00007FF6153E703B
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF6153D7586,?,?,?,00007FF6153D593D), ref: 00007FF6153E705F

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalMessagePostSection$EnterLeavefree
String ID:
API String ID: 1761621129-0
Opcode ID: f1368d2637383b9d1fbe88dd08f0b6b84c9096db0d7acdefe950a4f3b6a6cc67
Instruction ID: 255bb2bcb24cb22ed0a3eb0241c0b9c55a6986f088ebc181686e54f5210afd3e
Opcode Fuzzy Hash: f1368d2637383b9d1fbe88dd08f0b6b84c9096db0d7acdefe950a4f3b6a6cc67
Instruction Fuzzy Hash: 38513576615F8696EA598F5AE540268B3A0FB48FE0F048436DF4D87760EF39EC658300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153D6D40, Relevance: 7.6, APIs: 5, Instructions: 115COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF6153D5891), ref: 00007FF6153D6D88
DestroyWindow.USER32(?,?,00007FF6153D5891), ref: 00007FF6153D6DD1
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00007FF6153D5891), ref: 00007FF6153D6E02
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00007FF6153D5891), ref: 00007FF6153D6E3F
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00007FF6153D5891), ref: 00007FF6153D6E6B

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave$DestroyWindow
String ID:
API String ID: 1832709843-0
Opcode ID: 445cd7b2c83fd53663feb3fe2c57ed2270ab968ce6ae22e6d24482a85429bc3b
Instruction ID: 0df27958382d58d773943c506ec5a0d4ae078d49c0d5cecde47f980092d505ba
Opcode Fuzzy Hash: 445cd7b2c83fd53663feb3fe2c57ed2270ab968ce6ae22e6d24482a85429bc3b
Instruction Fuzzy Hash: 15413D26A28F4685EA549F96D550279A3B0FF88FA4F884436DE1E87774EF3CEC459300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153D8A90, Relevance: 7.6, APIs: 5, Instructions: 87threadCOMMON

Download Yara Rule

APIs

SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6153D8AD2
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6153D8B26
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153D8B36
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153D8B55
CreateWindowExW.USER32 ref: 00007FF6153D8BDB

Part of subcall function 00007FF6153E9998: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6153D4D5D), ref: 00007FF6153E999E
Part of subcall function 00007FF6153E9998: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6153D4D5D), ref: 00007FF6153E99B0

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalHeapSection$AllocCreateCurrentEnterErrorLastLeaveProcessThreadWindow
String ID:
API String ID: 213679520-0
Opcode ID: 96778fead3afdad286395f4779ba16398e941bb0e3e5cac3c9999b81a3f73a37
Instruction ID: bfea39f58feb936f75682debdea911c2623d9644056857684be037fabb1a8053
Opcode Fuzzy Hash: 96778fead3afdad286395f4779ba16398e941bb0e3e5cac3c9999b81a3f73a37
Instruction Fuzzy Hash: 11411A36628F8686DB64CF12A844569F7B4FB58FA0F544435EA8D83B64EF3CE851CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153DBD70, Relevance: 7.6, APIs: 5, Instructions: 60windowtimeCOMMON

Download Yara Rule

APIs

KillTimer.USER32 ref: 00007FF6153DBDFC
EnableWindow.USER32 ref: 00007FF6153DBE16
EnableWindow.USER32 ref: 00007FF6153DBE25
SendMessageW.USER32 ref: 00007FF6153DBE3D
SendMessageW.USER32 ref: 00007FF6153DBE56

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: EnableMessageSendWindow$KillTimer
String ID:
API String ID: 1530760411-0
Opcode ID: 790b771797b1c37bd3a3a0ab7867dc0f4f4a91b1fa86e4f30b08ad8aa3c16f5c
Instruction ID: c208d85bea3fcd0ed4c767c52736662d7c8afe1c80ca25606a1ee59d3a9959b9
Opcode Fuzzy Hash: 790b771797b1c37bd3a3a0ab7867dc0f4f4a91b1fa86e4f30b08ad8aa3c16f5c
Instruction Fuzzy Hash: 6231C536B25E4986EB49CF6AD8A47A96360FB88F58F444432CE0D8B768DF3DD845C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E3F10, Relevance: 7.6, APIs: 5, Instructions: 53windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153E3F48
PathParseIconLocationW.SHLWAPI ref: 00007FF6153E3F51

Part of subcall function 00007FF6153EE65C: FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6153E1A2F), ref: 00007FF6153EE830

DestroyIcon.USER32 ref: 00007FF6153E3F7D
PostMessageW.USER32 ref: 00007FF6153E3FC2
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153E3FCC

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalIconSection$DestroyEnterFreeLeaveLibraryLocationMessageParsePathPost
String ID:
API String ID: 2815019517-0
Opcode ID: f7339be12a03a37501baedaeb3216cd5e10e2d9fc6130e96c3122bb16b12d3e0
Instruction ID: e76cebdf66ca25e45a671d83af615e741049044865dfcb13f5484e8b06cdaca8
Opcode Fuzzy Hash: f7339be12a03a37501baedaeb3216cd5e10e2d9fc6130e96c3122bb16b12d3e0
Instruction Fuzzy Hash: 63214C32624A4586EB118B16F884379A3A0EB49FA4F144432DA4E87B74EF3DEC89C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E9998, Relevance: 7.5, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6153D4D5D), ref: 00007FF6153E999E
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6153D4D5D), ref: 00007FF6153E99B0
DecodePointer.API-MS-WIN-CORE-UTIL-L1-1-0(?,?,00000000,00007FF6153D4D5D), ref: 00007FF6153E99D2
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6153D4D5D), ref: 00007FF6153E9A0A
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6153D4D5D), ref: 00007FF6153E9A18

Part of subcall function 00007FF6153E9C3C: LoadLibraryExA.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,00000000,00007FF6153E99DF,?,?,00000000,00007FF6153D4D5D), ref: 00007FF6153E9C51
Part of subcall function 00007FF6153E9C3C: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,00000000,00007FF6153E99DF,?,?,00000000,00007FF6153D4D5D), ref: 00007FF6153E9C6D
Part of subcall function 00007FF6153E9C3C: EncodePointer.API-MS-WIN-CORE-UTIL-L1-1-0(?,?,00000000,00007FF6153E99DF,?,?,00000000,00007FF6153D4D5D), ref: 00007FF6153E9C7F
Part of subcall function 00007FF6153E9C3C: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,00000000,00007FF6153E99DF,?,?,00000000,00007FF6153D4D5D), ref: 00007FF6153E9C96
Part of subcall function 00007FF6153E9C3C: EncodePointer.API-MS-WIN-CORE-UTIL-L1-1-0(?,?,00000000,00007FF6153E99DF,?,?,00000000,00007FF6153D4D5D), ref: 00007FF6153E9CA4
Part of subcall function 00007FF6153E9C3C: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,00000000,00007FF6153E99DF,?,?,00000000,00007FF6153D4D5D), ref: 00007FF6153E9CBB
Part of subcall function 00007FF6153E9C3C: EncodePointer.API-MS-WIN-CORE-UTIL-L1-1-0(?,?,00000000,00007FF6153E99DF,?,?,00000000,00007FF6153D4D5D), ref: 00007FF6153E9CC9
Part of subcall function 00007FF6153E9C3C: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,00000000,00007FF6153E99DF,?,?,00000000,00007FF6153D4D5D), ref: 00007FF6153E9CE0
Part of subcall function 00007FF6153E9C3C: EncodePointer.API-MS-WIN-CORE-UTIL-L1-1-0(?,?,00000000,00007FF6153E99DF,?,?,00000000,00007FF6153D4D5D), ref: 00007FF6153E9CEE

Part of subcall function 00007FF6153E97FC: InterlockedPopEntrySList.API-MS-WIN-CORE-INTERLOCKED-L1-1-0(?,?,00000000,00007FF6153E9A01,?,?,00000000,00007FF6153D4D5D), ref: 00007FF6153E9822

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Pointer$AddressEncodeHeapProc$Process$AllocDecodeEntryFreeInterlockedLibraryListLoad
String ID:
API String ID: 497791061-0
Opcode ID: e92bb254f33b8bbb2634b171d9783a9fd60de6c46da4db122282008c1da3f8ba
Instruction ID: ad0a66798dd233e28469dbff001ed062c7c89ae5ba1c099f5e30121c20ab08b6
Opcode Fuzzy Hash: e92bb254f33b8bbb2634b171d9783a9fd60de6c46da4db122282008c1da3f8ba
Instruction Fuzzy Hash: 4501E922E3AE4381FA599B669854278A2D0EF45F64F044436D80ED73B4FF3CBC858311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E8AE8, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

multimedia\deviceui\volume\sndvolexe\immersiveicon.cpp, xrefs: 00007FF6153E8B3C, 00007FF6153E8BD2, 00007FF6153E8C79

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: multimedia\deviceui\volume\sndvolexe\immersiveicon.cpp
API String ID: 0-409861629
Opcode ID: 11c292cfd89c751c36991ecb4093aa6a124cbacee69bba56aba616095fa788cc
Instruction ID: 42f4097835f5d46a79aaef8292faf24dc8e03969286d410a9d6fb797565659ee
Opcode Fuzzy Hash: 11c292cfd89c751c36991ecb4093aa6a124cbacee69bba56aba616095fa788cc
Instruction Fuzzy Hash: CC415E76B14A429AE710CF66E4406ADB3B1FB48F98F409036DE0D97B69EF38E945C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153ED714, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106windowCOMMON

Download Yara Rule

APIs

BitBlt.GDI32 ref: 00007FF6153ED7D1
DrawThemeBackground.UXTHEME ref: 00007FF6153ED7FD
DrawThemeBackground.UXTHEME ref: 00007FF6153ED862

Strings

, xrefs: 00007FF6153ED7B0

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: BackgroundDrawTheme
String ID:
API String ID: 4081691586-3916222277
Opcode ID: 16ad8afa2327ee1ec45f3b91fa30b9f93c8598be37a5e5149636d656b1c9f6f7
Instruction ID: 50b25bdd5616f4fed81546f8bfe7f86c797fac6f67a09ad420cb879a1b28dd66
Opcode Fuzzy Hash: 16ad8afa2327ee1ec45f3b91fa30b9f93c8598be37a5e5149636d656b1c9f6f7
Instruction Fuzzy Hash: 3B418B76B14B419EE7148F76E8406AD73A0FB49B98F404539EE4D87B58EF38E928C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E6180, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59COMMON

Download Yara Rule

Strings

mmsys.cpl,,%s,listento, xrefs: 00007FF6153E61EB
mmsys.cpl,,sounds, xrefs: 00007FF6153E61A9

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorExecuteLastShellmemset
String ID: mmsys.cpl,,%s,listento$mmsys.cpl,,sounds
API String ID: 486181658-2271115306
Opcode ID: 7ae02045cf9f8535ac2c4423037eef70cc4c5958c692e81d9f5d031129b3c09f
Instruction ID: 9f774dc8cc49c2205378ebed3e5ccae892c4fec3df0c8920e3d37476a7a420db
Opcode Fuzzy Hash: 7ae02045cf9f8535ac2c4423037eef70cc4c5958c692e81d9f5d031129b3c09f
Instruction Fuzzy Hash: BD318272A28E42C2EB508B59E848368B3A0FB44F78F541236DA5D876B4EF3CDC45D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153D1A70, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6153D1A97
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6153D1AAE

Strings

RtlDllShutdownInProgress, xrefs: 00007FF6153D1AA4
ntdll.dll, xrefs: 00007FF6153D1A90

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: RtlDllShutdownInProgress$ntdll.dll
API String ID: 1646373207-582119455
Opcode ID: 6bf9e62e9047bff39a2c298e94ec0790a3aa7330d86752d04844f21e97a43e8c
Instruction ID: 4115f9cba7812d9f1c9ad100355200f811339c4815ded437af08c7b7ef0b8ee0
Opcode Fuzzy Hash: 6bf9e62e9047bff39a2c298e94ec0790a3aa7330d86752d04844f21e97a43e8c
Instruction Fuzzy Hash: BEF0FE64E2AF0382FE058B59BC58170A3A0BF19F61F480436E82D87370FF2CAC489302

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153DE158, Relevance: 6.3, APIs: 4, Instructions: 270threadCOMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153DE1CD
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153DE454
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6153DE4B2
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6153DE53A

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentExclusiveLockReleaseThread
String ID:
API String ID: 2448954584-0
Opcode ID: cf0929b3e0f205a5753e60361cafc939b2dc5395c49b6dc3eb08fce1eb86c9f2
Instruction ID: be5468d4a922cff1a78633ddbd41e7ae0bf4e5d5a0a6b7eb2b9aae6ebaeda95b
Opcode Fuzzy Hash: cf0929b3e0f205a5753e60361cafc939b2dc5395c49b6dc3eb08fce1eb86c9f2
Instruction Fuzzy Hash: 9AD16A72A15B818EEB50CF64E8803A9BBB4FB48F98F404535DA4D97B68EF38D851C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153DCF14, Relevance: 6.3, APIs: 4, Instructions: 269threadCOMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153DCF8A
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153DD211
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6153DD26F
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6153DD2F7

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentExclusiveLockReleaseThread
String ID:
API String ID: 2448954584-0
Opcode ID: 3e58f4448cdb639214e7de4a7739240ae674aef46234473e23a8c9231552eacb
Instruction ID: 8920d63c1a3a904091df7b1d40bbf8007722f4543d0058fe4a3ca07fe124ea84
Opcode Fuzzy Hash: 3e58f4448cdb639214e7de4a7739240ae674aef46234473e23a8c9231552eacb
Instruction Fuzzy Hash: 73D18972A15B848AEB50CF25E8843A8B7B4FB48F98F504535DA4E97B68EF3CD851C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153DDD50, Relevance: 6.3, APIs: 4, Instructions: 258threadCOMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153DDDC4
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153DE025
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6153DE072
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6153DE0C0

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentExclusiveLockReleaseThread
String ID:
API String ID: 2448954584-0
Opcode ID: f02e7bfa5ff3759789d96315327eca0cb80bd5069a4f17e4889827d328c1461b
Instruction ID: a00c15a89b3fa6c70de272dde8cd294c929f8f75698ba42b6944671a5eafe9c0
Opcode Fuzzy Hash: f02e7bfa5ff3759789d96315327eca0cb80bd5069a4f17e4889827d328c1461b
Instruction Fuzzy Hash: 10C19C72A15B418AEB50CF25E8843A8B7B4FB48F98F504531EE4E97B68EF38D851C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153DBE80, Relevance: 6.1, APIs: 4, Instructions: 139windowtimeCOMMON

Download Yara Rule

APIs

EnableWindow.USER32 ref: 00007FF6153DBFDE
EnableWindow.USER32 ref: 00007FF6153DBFEF
SendMessageW.USER32 ref: 00007FF6153DC026
SetTimer.USER32 ref: 00007FF6153DC054

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: EnableWindow$MessageSendTimer
String ID:
API String ID: 107662803-0
Opcode ID: af3bd8e8b7a9cb9b5125abca4ead6d0e86d88a30893d729ba39ed441065b0940
Instruction ID: 2bc8761a2c2f76264faadc6488a66d840443ee87d3848301f6c0c31ae7650ced
Opcode Fuzzy Hash: af3bd8e8b7a9cb9b5125abca4ead6d0e86d88a30893d729ba39ed441065b0940
Instruction Fuzzy Hash: CB513576724F0696EB14DB2AE884568B760FB88FA0B458132CF2D87770EF39E855C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E26C0, Relevance: 6.1, APIs: 4, Instructions: 87windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153E2705
_wcsicmp.MSVCRT ref: 00007FF6153E2736
PostMessageW.USER32 ref: 00007FF6153E27CE
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153E27D8

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeaveMessagePost_wcsicmp
String ID:
API String ID: 3824780271-0
Opcode ID: a9658a683531e3b59d9f1cb75ca473aff76121a72ca903d37683d35141a8e69a
Instruction ID: c665bcde92616d916360a57494bc96f1337420957a56cc710d8da9e3ecd29e3c
Opcode Fuzzy Hash: a9658a683531e3b59d9f1cb75ca473aff76121a72ca903d37683d35141a8e69a
Instruction Fuzzy Hash: A4313026A24B4196EB148F16E84066AA7A0FB98FA4F144136EE5D87775EF3CE845C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E6D60, Relevance: 6.1, APIs: 4, Instructions: 84windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF6153D75CB,?,?,?,00007FF6153D593D), ref: 00007FF6153E6D80
PostMessageW.USER32 ref: 00007FF6153E6E11
PostMessageW.USER32 ref: 00007FF6153E6E4B
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF6153D75CB,?,?,?,00007FF6153D593D), ref: 00007FF6153E6E71

Part of subcall function 00007FF6153E66D4: GetDlgItem.USER32 ref: 00007FF6153E672F
Part of subcall function 00007FF6153E66D4: ShowWindow.USER32(?,?,00000000,00007FF6153E6E96,?,?,?,00007FF6153D75CB,?,?,?,00007FF6153D593D), ref: 00007FF6153E673A
Part of subcall function 00007FF6153E66D4: ShowWindow.USER32(?,?,00000000,00007FF6153E6E96,?,?,?,00007FF6153D75CB,?,?,?,00007FF6153D593D), ref: 00007FF6153E674C
Part of subcall function 00007FF6153E66D4: SendMessageW.USER32(?,?,00000000,00007FF6153E6E96,?,?,?,00007FF6153D75CB,?,?,?,00007FF6153D593D), ref: 00007FF6153E6764

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$CriticalPostSectionShowWindow$EnterItemLeaveSend
String ID:
API String ID: 3112685719-0
Opcode ID: 2f1f75c04ecb5c434a5c04266b29c8811cb4ffe6475c6b0bb6e52abea3c8f9f5
Instruction ID: a8d65b1fe5d45157b7098e35ae32113e8929500555505aeb36d9894022354362
Opcode Fuzzy Hash: 2f1f75c04ecb5c434a5c04266b29c8811cb4ffe6475c6b0bb6e52abea3c8f9f5
Instruction Fuzzy Hash: D1310C36A29F4592EE449F57E950169A3A0FB88FA0B484436DE0D877A5EF3CEC65C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E1610, Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007FF6153E164B
calloc.MSVCRT ref: 00007FF6153E1688
memmove_s.MSVCRT ref: 00007FF6153E16A7
free.MSVCRT ref: 00007FF6153E16C8

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: calloc$freememmove_s
String ID:
API String ID: 3942310398-0
Opcode ID: 4591e81f83599bd8d46eec4551d2403ebef93a2e01419e764c0de738d8c461ac
Instruction ID: f9a686eb3cd10d9d4350ca51a006403e8d7049b92a83867580a2263faa439b17
Opcode Fuzzy Hash: 4591e81f83599bd8d46eec4551d2403ebef93a2e01419e764c0de738d8c461ac
Instruction Fuzzy Hash: 2221B161B19F0182EE589B56D554378A2E1EF49FE8F184436CD1E87BB8EF2CEC408601

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153EEE20, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF6153EEE93
RtlLookupFunctionEntry.NTDLL ref: 00007FF6153EEEB2
RtlVirtualUnwind.NTDLL ref: 00007FF6153EEEFF
__raise_securityfailure.LIBCMT ref: 00007FF6153EEFE4

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: d9f9bc735f26f21f86b4b42060c24bb28d112025c06cb2b6d639f527e2aee33e
Instruction ID: b9ddbde0b898f79be2944054d94ce167f0c837b5517bcab1688dd8866d922153
Opcode Fuzzy Hash: d9f9bc735f26f21f86b4b42060c24bb28d112025c06cb2b6d639f527e2aee33e
Instruction Fuzzy Hash: 9041B035A29F0185EA108B09F888365B3A4FB88F64F904436D99DC77B4EF3CE848D741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153ECB20, Relevance: 6.1, APIs: 4, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00007FF6153ECB40
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,00000130,00007FF6153DB9BF), ref: 00007FF6153ECB57
CopyRect.USER32 ref: 00007FF6153ECBC0
SendMessageW.USER32 ref: 00007FF6153ECC14

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageRectSend$ClientCopy
String ID:
API String ID: 624215159-0
Opcode ID: a0c8d2c6ff2bede5468fddd76c0cd61eaf7c61bfd5a17a3b44ded7a63950be90
Instruction ID: 82cf91a1d97b0400425317be7e6169620ce0f242d37af2eb75ee8a0efd658603
Opcode Fuzzy Hash: a0c8d2c6ff2bede5468fddd76c0cd61eaf7c61bfd5a17a3b44ded7a63950be90
Instruction Fuzzy Hash: F0313572624681CBE761CF39D445B6DB3A1F788F58F44413ADA098BA68DF38D856CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E4310, Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153E434E
free.MSVCRT ref: 00007FF6153E437A
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153E43A2
DeleteCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153E43AC

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$DeleteEnterLeavefree
String ID:
API String ID: 682159224-0
Opcode ID: c2c7bd32336eae30873e931d28b94058a9bd91811ea0f53551dffe8d24b7941f
Instruction ID: 85d5a4a01c218178f503652de791e2b584514a54a72aa67ad948e3f6222e20df
Opcode Fuzzy Hash: c2c7bd32336eae30873e931d28b94058a9bd91811ea0f53551dffe8d24b7941f
Instruction Fuzzy Hash: D8212F25A29F0192EB149F66E44023DA360FB49FA4F144636DA6D437B4EF3DDC55C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153DB554, Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF6153DB57F
DestroyIcon.USER32 ref: 00007FF6153DB5A2
DestroyIcon.USER32 ref: 00007FF6153DB5B5
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6153DB5C8

Part of subcall function 00007FF6153DBD70: KillTimer.USER32 ref: 00007FF6153DBDFC
Part of subcall function 00007FF6153DBD70: EnableWindow.USER32 ref: 00007FF6153DBE16
Part of subcall function 00007FF6153DBD70: EnableWindow.USER32 ref: 00007FF6153DBE25
Part of subcall function 00007FF6153DBD70: SendMessageW.USER32 ref: 00007FF6153DBE3D
Part of subcall function 00007FF6153DBD70: SendMessageW.USER32 ref: 00007FF6153DBE56

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$DestroyEnableIconMessageSend$CloseHandleKillTimer
String ID:
API String ID: 153888860-0
Opcode ID: be7f0bb75675b2a4d70237cebb2135babe44183563422e3adc72d4652ba64a50
Instruction ID: a3107f809ba079ec379a8504d7605bd96bc6f8e0fc45ba56b20c396f384a05b8
Opcode Fuzzy Hash: be7f0bb75675b2a4d70237cebb2135babe44183563422e3adc72d4652ba64a50
Instruction Fuzzy Hash: 1D215C21A2AE0286EB599F21D8643B8A3A4FF45F74F441636D91E832B0EF2C9C45C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153EDE9C, Relevance: 6.0, APIs: 4, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PtInRect.USER32 ref: 00007FF6153EDED4

Part of subcall function 00007FF6153EDE30: IsWindowEnabled.USER32 ref: 00007FF6153EDE47

InvalidateRect.USER32 ref: 00007FF6153EDEFD
GetParent.USER32 ref: 00007FF6153EDF1D
SendMessageW.USER32 ref: 00007FF6153EDF31

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$EnabledInvalidateMessageParentSendWindow
String ID:
API String ID: 2770887159-0
Opcode ID: 853c731c7ddec63cacb44fe68cce1a15dbf9cb8dcc3057ebbfb938a202475e11
Instruction ID: 10cd819724c5c31c4cac3a5968054ee833b607bfe879d865c9608a17f4e66734
Opcode Fuzzy Hash: 853c731c7ddec63cacb44fe68cce1a15dbf9cb8dcc3057ebbfb938a202475e11
Instruction Fuzzy Hash: 84112432A28A4186E750CF26E45477AB7A0F788FA4F445436EE4D87B28DF3CD842C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E3E60, Relevance: 6.0, APIs: 4, Instructions: 44windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153E3E79
CoTaskMemFree.OLE32 ref: 00007FF6153E3E88
PostMessageW.USER32 ref: 00007FF6153E3EE9
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6153E3EF3

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeLeaveMessagePostTask
String ID:
API String ID: 2266478588-0
Opcode ID: 71c845cb49e42b943537a38e88d680ba0019ef6f5648a1c39e206f105fdc33c8
Instruction ID: e07d8f22819721c252d9d7b2da52211bd37d7b76775a06ddec08a16b08504154
Opcode Fuzzy Hash: 71c845cb49e42b943537a38e88d680ba0019ef6f5648a1c39e206f105fdc33c8
Instruction Fuzzy Hash: B711FB36629E4582EB54DF26E454329A3A0FB88FA4F044535EE4E87B68EF3DDC46C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E66D4, Relevance: 6.0, APIs: 4, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6153E672F
ShowWindow.USER32(?,?,00000000,00007FF6153E6E96,?,?,?,00007FF6153D75CB,?,?,?,00007FF6153D593D), ref: 00007FF6153E673A
ShowWindow.USER32(?,?,00000000,00007FF6153E6E96,?,?,?,00007FF6153D75CB,?,?,?,00007FF6153D593D), ref: 00007FF6153E674C
SendMessageW.USER32(?,?,00000000,00007FF6153E6E96,?,?,?,00007FF6153D75CB,?,?,?,00007FF6153D593D), ref: 00007FF6153E6764

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ShowWindow$ItemMessageSend
String ID:
API String ID: 3326751023-0
Opcode ID: aa9444613097baf834552cb70db8263049beaa161eaff9cf3f57ef772f6ec78e
Instruction ID: 9d90f2f986aac2b24ea9e689ee4d4a160dbc3dc13283e8654a617b672cedb1ef
Opcode Fuzzy Hash: aa9444613097baf834552cb70db8263049beaa161eaff9cf3f57ef772f6ec78e
Instruction Fuzzy Hash: 2D113036714E81D7DB5C9B22E5942A9B361FB88F65F044035DB1A87760DF38ECA4C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153E9AE4, Relevance: 6.0, APIs: 4, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.API-MS-WIN-CORE-INTERLOCKED-L1-1-0 ref: 00007FF6153E9B06
DecodePointer.API-MS-WIN-CORE-UTIL-L1-1-0 ref: 00007FF6153E9B1E
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6153E9B3A
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6153E9B48

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$DecodeEntryFreeInterlockedListPointerProcessPush
String ID:
API String ID: 815838099-0
Opcode ID: 212d3b56b9885f26246731c856b44bf11df8a6f604c93e0b5c86749a98997aa0
Instruction ID: 85be3068ad4924d0bdf7d92392bb7fae692629edc54d1b561ae05e0dbdc41101
Opcode Fuzzy Hash: 212d3b56b9885f26246731c856b44bf11df8a6f604c93e0b5c86749a98997aa0
Instruction Fuzzy Hash: D901FB62D29D03D1FA599B56D818234E2A0EF45FA5F184032D91D872B4FF6CAC85C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153DF190, Relevance: 5.0, APIs: 4, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6153DFA53), ref: 00007FF6153DF1B7
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6153DFA53), ref: 00007FF6153DF1C9
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6153DFA53), ref: 00007FF6153DF1E2
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6153DFA53), ref: 00007FF6153DF1F1

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 3f743dafa0f30a8ada20ae13fe9acd3c4a78917da60a18e437d6f29fa3814ca8
Instruction ID: b3442e3f17bd249da5988cb892805ccb2ac2cf4a4cbf925f9ebe8bdae02a023f
Opcode Fuzzy Hash: 3f743dafa0f30a8ada20ae13fe9acd3c4a78917da60a18e437d6f29fa3814ca8
Instruction Fuzzy Hash: 54118232A14E8292E748DF65E984268B3B0FF44F60F448135D72E87264EF3898B48700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6153D2958, Relevance: 5.0, APIs: 4, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6153D2989
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6153D2997
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6153D29B5
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6153D29C3

Memory Dump Source

Source File: 00000016.00000002.353801279.00007FF6153D1000.00000020.00020000.sdmp, Offset: 00007FF6153D0000, based on PE: true

Associated: 00000016.00000002.353787660.00007FF6153D0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353824217.00007FF6153F2000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.353843424.00007FF6153FD000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.353857651.00007FF6153FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 452ad214f92b1686df152222964b476890bf41e98d5bb34ffca0b15c09efe02d
Instruction ID: 3f94eb11e8ffcd73a4c4ed6f58c511f4c8c00ca6fb7a737403a55a7aecb84673
Opcode Fuzzy Hash: 452ad214f92b1686df152222964b476890bf41e98d5bb34ffca0b15c09efe02d
Instruction Fuzzy Hash: AC01DE72A14F55C6DB148F56E844059B7B5FB58FA4B584036EB8D43B28EF38D8A1C740

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	AWS CloudTrail logs, Authentication logs, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.
Tactics:	Defense Evasion
Data Sources:	File monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 2qTIaOLW2o

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Protection of GUI:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

Code Manipulations

Statistics

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre